aboutsummaryrefslogtreecommitdiffhomepage
path: root/cmd/fsu
diff options
context:
space:
mode:
Diffstat (limited to 'cmd/fsu')
-rw-r--r--cmd/fsu/main.go146
-rw-r--r--cmd/fsu/package.nix30
-rw-r--r--cmd/fsu/parse.go67
-rw-r--r--cmd/fsu/parse_test.go96
-rw-r--r--cmd/fsu/path.go21
5 files changed, 0 insertions, 360 deletions
diff --git a/cmd/fsu/main.go b/cmd/fsu/main.go
deleted file mode 100644
index 33ecbf43..00000000
--- a/cmd/fsu/main.go
+++ /dev/null
@@ -1,146 +0,0 @@
-package main
-
-import (
- "bytes"
- "fmt"
- "log"
- "os"
- "path"
- "slices"
- "strconv"
- "strings"
- "syscall"
-)
-
-const (
- fsuConfFile = "/etc/fsurc"
- envShim = "FORTIFY_SHIM"
- envAID = "FORTIFY_APP_ID"
- envGroups = "FORTIFY_GROUPS"
-
- PR_SET_NO_NEW_PRIVS = 0x26
-)
-
-func main() {
- log.SetFlags(0)
- log.SetPrefix("fsu: ")
- log.SetOutput(os.Stderr)
-
- if os.Geteuid() != 0 {
- log.Fatal("this program must be owned by uid 0 and have the setuid bit set")
- }
-
- puid := os.Getuid()
- if puid == 0 {
- log.Fatal("this program must not be started by root")
- }
-
- var toolPath string
- pexe := path.Join("/proc", strconv.Itoa(os.Getppid()), "exe")
- if p, err := os.Readlink(pexe); err != nil {
- log.Fatalf("cannot read parent executable path: %v", err)
- } else if strings.HasSuffix(p, " (deleted)") {
- log.Fatal("fortify executable has been deleted")
- } else if p != mustCheckPath(fmain) && p != mustCheckPath(fpkg) {
- log.Fatal("this program must be started by fortify")
- } else {
- toolPath = p
- }
-
- // uid = 1000000 +
- // fid * 10000 +
- // aid
- uid := 1000000
-
- // refuse to run if fsurc is not protected correctly
- if s, err := os.Stat(fsuConfFile); err != nil {
- log.Fatal(err)
- } else if s.Mode().Perm() != 0400 {
- log.Fatal("bad fsurc perm")
- } else if st := s.Sys().(*syscall.Stat_t); st.Uid != 0 || st.Gid != 0 {
- log.Fatal("fsurc must be owned by uid 0")
- }
-
- // authenticate before accepting user input
- if f, err := os.Open(fsuConfFile); err != nil {
- log.Fatal(err)
- } else if fid, ok := mustParseConfig(f, puid); !ok {
- log.Fatalf("uid %d is not in the fsurc file", puid)
- } else {
- uid += fid * 10000
- }
-
- // allowed aid range 0 to 9999
- if as, ok := os.LookupEnv(envAID); !ok {
- log.Fatal("FORTIFY_APP_ID not set")
- } else if aid, err := parseUint32Fast(as); err != nil || aid < 0 || aid > 9999 {
- log.Fatal("invalid aid")
- } else {
- uid += aid
- }
-
- // pass through setup fd to shim
- var shimSetupFd string
- if s, ok := os.LookupEnv(envShim); !ok {
- // fortify requests target uid
- // print resolved uid and exit
- fmt.Print(uid)
- os.Exit(0)
- } else if len(s) != 1 || s[0] > '9' || s[0] < '3' {
- log.Fatal("FORTIFY_SHIM holds an invalid value")
- } else {
- shimSetupFd = s
- }
-
- // supplementary groups
- var suppGroups, suppCurrent []int
-
- if gs, ok := os.LookupEnv(envGroups); ok {
- if cur, err := os.Getgroups(); err != nil {
- log.Fatalf("cannot get groups: %v", err)
- } else {
- suppCurrent = cur
- }
-
- // parse space-separated list of group ids
- gss := bytes.Split([]byte(gs), []byte{' '})
- suppGroups = make([]int, len(gss)+1)
- for i, s := range gss {
- if gid, err := strconv.Atoi(string(s)); err != nil {
- log.Fatalf("cannot parse %q: %v", string(s), err)
- } else if gid > 0 && gid != uid && gid != os.Getgid() && slices.Contains(suppCurrent, gid) {
- suppGroups[i] = gid
- } else {
- log.Fatalf("invalid gid %d", gid)
- }
- }
- suppGroups[len(suppGroups)-1] = uid
- } else {
- suppGroups = []int{uid}
- }
-
- // final bounds check to catch any bugs
- if uid < 1000000 || uid >= 2000000 {
- panic("uid out of bounds")
- }
-
- // careful! users in the allowlist is effectively allowed to drop groups via fsu
-
- if err := syscall.Setresgid(uid, uid, uid); err != nil {
- log.Fatalf("cannot set gid: %v", err)
- }
- if err := syscall.Setgroups(suppGroups); err != nil {
- log.Fatalf("cannot set supplementary groups: %v", err)
- }
- if err := syscall.Setresuid(uid, uid, uid); err != nil {
- log.Fatalf("cannot set uid: %v", err)
- }
- if _, _, errno := syscall.AllThreadsSyscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0); errno != 0 {
- log.Fatalf("cannot set no_new_privs flag: %s", errno.Error())
- }
- if err := syscall.Exec(toolPath, []string{"fortify", "shim"}, []string{envShim + "=" + shimSetupFd}); err != nil {
- log.Fatalf("cannot start shim: %v", err)
- }
-
- panic("unreachable")
-}
diff --git a/cmd/fsu/package.nix b/cmd/fsu/package.nix
deleted file mode 100644
index ab5c4b4d..00000000
--- a/cmd/fsu/package.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
- lib,
- buildGoModule,
- fortify ? abort "fortify package required",
-}:
-
-buildGoModule {
- pname = "${fortify.pname}-fsu";
- inherit (fortify) version;
-
- src = ./.;
- inherit (fortify) vendorHash;
- env.CGO_ENABLED = 0;
-
- preBuild = ''
- go mod init fsu >& /dev/null
- '';
-
- ldflags =
- lib.attrsets.foldlAttrs
- (
- ldflags: name: value:
- ldflags ++ [ "-X main.${name}=${value}" ]
- )
- [ "-s -w" ]
- {
- fmain = "${fortify}/libexec/fortify";
- fpkg = "${fortify}/libexec/fpkg";
- };
-}
diff --git a/cmd/fsu/parse.go b/cmd/fsu/parse.go
deleted file mode 100644
index 4b3e22a8..00000000
--- a/cmd/fsu/parse.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package main
-
-import (
- "bufio"
- "errors"
- "fmt"
- "io"
- "log"
- "strings"
-)
-
-func parseUint32Fast(s string) (int, error) {
- sLen := len(s)
- if sLen < 1 {
- return -1, errors.New("zero length string")
- }
- if sLen > 10 {
- return -1, errors.New("string too long")
- }
-
- n := 0
- for i, ch := range []byte(s) {
- ch -= '0'
- if ch > 9 {
- return -1, fmt.Errorf("invalid character '%s' at index %d", string(ch+'0'), i)
- }
- n = n*10 + int(ch)
- }
- return n, nil
-}
-
-func parseConfig(r io.Reader, puid int) (fid int, ok bool, err error) {
- s := bufio.NewScanner(r)
- var line, puid0 int
- for s.Scan() {
- line++
-
- // <puid> <fid>
- lf := strings.SplitN(s.Text(), " ", 2)
- if len(lf) != 2 {
- return -1, false, fmt.Errorf("invalid entry on line %d", line)
- }
-
- puid0, err = parseUint32Fast(lf[0])
- if err != nil || puid0 < 1 {
- return -1, false, fmt.Errorf("invalid parent uid on line %d", line)
- }
-
- ok = puid0 == puid
- if ok {
- // allowed fid range 0 to 99
- if fid, err = parseUint32Fast(lf[1]); err != nil || fid < 0 || fid > 99 {
- return -1, false, fmt.Errorf("invalid fortify uid on line %d", line)
- }
- return
- }
- }
- return -1, false, s.Err()
-}
-
-func mustParseConfig(r io.Reader, puid int) (int, bool) {
- fid, ok, err := parseConfig(r, puid)
- if err != nil {
- log.Fatal(err)
- }
- return fid, ok
-}
diff --git a/cmd/fsu/parse_test.go b/cmd/fsu/parse_test.go
deleted file mode 100644
index baa239bc..00000000
--- a/cmd/fsu/parse_test.go
+++ /dev/null
@@ -1,96 +0,0 @@
-package main
-
-import (
- "bytes"
- "strconv"
- "testing"
-)
-
-func Test_parseUint32Fast(t *testing.T) {
- t.Run("zero-length", func(t *testing.T) {
- if _, err := parseUint32Fast(""); err == nil || err.Error() != "zero length string" {
- t.Errorf(`parseUint32Fast(""): error = %v`, err)
- return
- }
- })
- t.Run("overflow", func(t *testing.T) {
- if _, err := parseUint32Fast("10000000000"); err == nil || err.Error() != "string too long" {
- t.Errorf("parseUint32Fast: error = %v", err)
- return
- }
- })
- t.Run("invalid byte", func(t *testing.T) {
- if _, err := parseUint32Fast("meow"); err == nil || err.Error() != "invalid character 'm' at index 0" {
- t.Errorf(`parseUint32Fast("meow"): error = %v`, err)
- return
- }
- })
- t.Run("full range", func(t *testing.T) {
- testRange := func(i, end int) {
- for ; i < end; i++ {
- s := strconv.Itoa(i)
- w := i
- t.Run("parse "+s, func(t *testing.T) {
- t.Parallel()
- v, err := parseUint32Fast(s)
- if err != nil {
- t.Errorf("parseUint32Fast(%q): error = %v",
- s, err)
- return
- }
- if v != w {
- t.Errorf("parseUint32Fast(%q): got %v",
- s, v)
- return
- }
- })
- }
- }
-
- testRange(0, 5000)
- testRange(105000, 110000)
- testRange(23005000, 23010000)
- testRange(456005000, 456010000)
- testRange(7890005000, 7890010000)
- })
-}
-
-func Test_parseConfig(t *testing.T) {
- testCases := []struct {
- name string
- puid, want int
- wantErr string
- rc string
- }{
- {"empty", 0, -1, "", ``},
- {"invalid field", 0, -1, "invalid entry on line 1", `9`},
- {"invalid puid", 0, -1, "invalid parent uid on line 1", `f 9`},
- {"invalid fid", 1000, -1, "invalid fortify uid on line 1", `1000 f`},
- {"match", 1000, 0, "", `1000 0`},
- }
-
- for _, tc := range testCases {
- t.Run(tc.name, func(t *testing.T) {
- fid, ok, err := parseConfig(bytes.NewBufferString(tc.rc), tc.puid)
- if err == nil && tc.wantErr != "" {
- t.Errorf("parseConfig: error = %v; wantErr %q",
- err, tc.wantErr)
- return
- }
- if err != nil && err.Error() != tc.wantErr {
- t.Errorf("parseConfig: error = %q; wantErr %q",
- err, tc.wantErr)
- return
- }
- if ok == (tc.want == -1) {
- t.Errorf("parseConfig: ok = %v; want %v",
- ok, tc.want)
- return
- }
- if fid != tc.want {
- t.Errorf("parseConfig: fid = %v; want %v",
- fid, tc.want)
- }
- })
- }
-}
diff --git a/cmd/fsu/path.go b/cmd/fsu/path.go
deleted file mode 100644
index 6ed5600e..00000000
--- a/cmd/fsu/path.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package main
-
-import (
- "log"
- "path"
-)
-
-const compPoison = "INVALIDINVALIDINVALIDINVALIDINVALID"
-
-var (
- fmain = compPoison
- fpkg = compPoison
-)
-
-func mustCheckPath(p string) string {
- if p != compPoison && p != "" && path.IsAbs(p) {
- return p
- }
- log.Fatal("this program is compiled incorrectly")
- return compPoison
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 15:37:10 +0000