1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
/* vi: set sw=4 ts=4: */
/*
* Mini getpty implementation for busybox
* Bjorn Wesen, Axis Communications AB (bjornw@axis.com)
*
* Licensed under GPLv2 or later, see file LICENSE in this source tree.
*/
#include "libbb.h"
#define DEBUG 0
// On modern systems (old ways were more kludgy with setuid "pt_chown" binary):
// ptyfd = open("/dev/ptmx"):
// Kernel creates slave /dev/pts/N with owner = real UID of opener,
// group and mode as configured by /dev/pts mount options.
// The mode is safe with standard mount options (gid=5,mode=620).
//
// grantpt(ptyfd) is now only a verification step. In glibc:
// Calls ioctl(fd, TIOCGPTN, &minor) to confirm ptyfd is valid master pty.
// If ioctl fails with ENOTTY, remaps to EINVAL (POSIX).
// Otherwise returns 0. (No chown/chmod occurs.)
//
// unlockpt(ptyfd) is ioctl(TIOCSPTLCK, 0): clears optional protection flag
// on slave. If flag was set, open(slave) fails with EIO for everyone (even root)
// until unlocked. [Do modern kernels still set the lock in open("/dev/ptmx")?]
// The lock historically prevented opening slave before grantpt() fixes perms
// in misconfigured/old setups where kernel didn't set 0620 atomically.
// Today it's mostly belt-and-suspenders + POSIX compatibility.
//
// The attack thwarted by the lock (assuming unprivileged adversary):
// you open /dev/ptmx, kernel allocates /dev/pts/N with overly permissive mode.
// Adversary manages to open /dev/pts/N before your grantpt() call
// locks down permissions.
// Typically, /dev/pts mount options are gid=5,mode=620, 5 = "tty" group,
// system is set up with only trusted binaries and no users in "tty" group.
// In this case, the locking mechanism is overkill (would be safe without it).
// To fortify more, you can mount with gid=0,mode=600. Tools like "wall",
// "mesg" would stop working.
// Processes with my own UID can still race against me, but I probably
// trust myself...
//
// ptsname(ptyfd), internally ioctl(TIOCGPTN): get index, build
// "/dev/pts/NN" string which refers to the slave pty.
int FAST_FUNC xgetpty(char *line)
{
#if ENABLE_FEATURE_DEVPTS
int ptyfd;
ptyfd = open("/dev/ptmx", O_RDWR);
if (ptyfd < 0)
bb_simple_perror_msg_and_die("can't find free pty");
grantpt(ptyfd); /* chmod+chown corresponding slave pty */
unlockpt(ptyfd); /* allow open() on slave /dev node */
# ifndef HAVE_PTSNAME_R
{
const char *name;
name = ptsname(ptyfd); /* find out the name of slave pty */
if (!name) {
bb_simple_perror_msg_and_die("ptsname error (is /dev/pts mounted?)");
}
safe_strncpy(line, name, GETPTY_BUFSIZE);
}
# else
/* find out the name of slave pty */
if (ptsname_r(ptyfd, line, GETPTY_BUFSIZE-1) != 0) {
bb_simple_perror_msg_and_die("ptsname error (is /dev/pts mounted?)");
}
line[GETPTY_BUFSIZE-1] = '\0';
# endif
return ptyfd;
#else
struct stat stb;
int ptyfd;
int i;
int j;
strcpy(line, "/dev/ptyXX");
for (i = 0; i < 16; i++) {
line[8] = "pqrstuvwxyzabcde"[i];
line[9] = '0';
if (stat(line, &stb) < 0) {
continue;
}
for (j = 0; j < 16; j++) {
line[9] = j < 10 ? j + '0' : j - 10 + 'a';
if (DEBUG)
fprintf(stderr, "Trying to open device: %s\n", line);
ptyfd = open(line, O_RDWR | O_NOCTTY);
if (ptyfd >= 0) {
line[5] = 't';
return ptyfd;
}
}
}
bb_simple_error_msg_and_die("can't find free pty");
#endif /* FEATURE_DEVPTS */
}
|
