summaryrefslogtreecommitdiffstats
path: root/libexec/ftpd
diff options
context:
space:
mode:
authoryar <yar@FreeBSD.org>2003-01-29 10:07:27 +0000
committeryar <yar@FreeBSD.org>2003-01-29 10:07:27 +0000
commite6e9500985f4f7ecfe47d94db27b2e1cb80f9f25 (patch)
tree8fde0f8caa19168edffd0451d6616eaaf5c4e9b3 /libexec/ftpd
parentd058571890b29a89c4d553f16608a810bfdcfe22 (diff)
downloadFreeBSD-src-e6e9500985f4f7ecfe47d94db27b2e1cb80f9f25.zip
FreeBSD-src-e6e9500985f4f7ecfe47d94db27b2e1cb80f9f25.tar.gz
Give the code around chroot(2)/chdir(2) a major overhaul by
separating its part around chroot(2) from that around initial chdir(2). This makes the below changes really easy. Move seteuid(to user's uid) to before calling chdir(2). There are two goals to achieve by that. First, NFS mounted home directories with restrictive permissions become accessible (local superuser can't access them if not mapped to uid 0 on the remote side explicitly.) Second, all the permissions to the home directory pathname components become effective; previously a user could be carried to any local directory despite its permissions since the chdir(2) was done with euid 0. This reduces possible impact from FTP server misconfiguration, e.g., assigning a wrong home directory to a user. Implement the "/./" feature. Now a guest or user subject to chrooting may have "/./" in his login directory, which separates his chroot directory from his home directory inside the chrooted environment. This works for ftpchroot(5) as well. PR: bin/17843 bin/23944
Diffstat (limited to 'libexec/ftpd')
-rw-r--r--libexec/ftpd/ftpchroot.520
-rw-r--r--libexec/ftpd/ftpcmd.y6
-rw-r--r--libexec/ftpd/ftpd.811
-rw-r--r--libexec/ftpd/ftpd.c105
4 files changed, 101 insertions, 41 deletions
diff --git a/libexec/ftpd/ftpchroot.5 b/libexec/ftpd/ftpchroot.5
index 8c8f629..ec14715 100644
--- a/libexec/ftpd/ftpchroot.5
+++ b/libexec/ftpd/ftpchroot.5
@@ -66,9 +66,16 @@ A username is specified otherwise.
The optional second field describes the directory for the user
or each member of the group to be locked up in using
.Xr chroot 2 .
+Be it omitted, the user's login directory will be used.
If it is not an absolute pathname, then it will be relative
to the user's login directory.
-Be this field omitted, the user's login directory will be used.
+If it contains the
+.Qq \&/./
+seprator,
+.Xr ftpd 8
+will treat its left-hand side as the name of the directory to do
+.Xr chroot 2
+to, and its right-hand side to change the current directory to afterwards.
.Sh FILES
.Bl -tag -width /etc/ftpchroot -compact
.It Pa /etc/ftpchroot
@@ -86,12 +93,17 @@ webuser
@hostee
.Ed
.Pp
-And this line will lock up the user
+And this line will tell
+.Xr ftpd 8
+to lock up the user
.Qq joe
in
-.Pa /var/spool/ftp :
+.Pa /var/spool/ftp
+and then to change the current directory to
+.Pa /joe ,
+which is relative to the session's new root:
.Bd -literal -offset indent
-joe /var/spool/ftp
+joe /var/spool/ftp/./joe
.Ed
.Pp
And finally the following line will lock up every user connecting
diff --git a/libexec/ftpd/ftpcmd.y b/libexec/ftpd/ftpcmd.y
index cb9f97f..261ffd0 100644
--- a/libexec/ftpd/ftpcmd.y
+++ b/libexec/ftpd/ftpcmd.y
@@ -78,6 +78,7 @@ extern union sockunion data_dest, his_addr;
extern int logged_in;
extern struct passwd *pw;
extern int guest;
+extern char *homedir;
extern int paranoid;
extern int logging;
extern int type;
@@ -535,10 +536,7 @@ cmd
| CWD check_login CRLF
{
if ($2) {
- if (guest)
- cwd("/");
- else
- cwd(pw->pw_dir);
+ cwd(homedir);
}
}
| CWD check_login SP pathname CRLF
diff --git a/libexec/ftpd/ftpd.8 b/libexec/ftpd/ftpd.8
index 9d9fd82..491c177 100644
--- a/libexec/ftpd/ftpd.8
+++ b/libexec/ftpd/ftpd.8
@@ -401,6 +401,17 @@ The server performs a
to the home directory of the
.Dq ftp
user.
+As a special case if the
+.Dq ftp
+user's home directory pathname contains the
+.Dq \&/./
+separator,
+.Nm
+uses its left-hand side as the name of the directory to do
+.Xr chroot 2
+to, and its right-hand side to change the current directory to afterwards.
+A typical example for this case would be
+.Pa /usr/local/ftp/./pub .
In order that system security is not breached, it is recommended
that the
.Dq ftp
diff --git a/libexec/ftpd/ftpd.c b/libexec/ftpd/ftpd.c
index 8d6d118..3d60f42 100644
--- a/libexec/ftpd/ftpd.c
+++ b/libexec/ftpd/ftpd.c
@@ -118,6 +118,7 @@ int data;
int dataport;
int logged_in;
struct passwd *pw;
+char *homedir;
int ftpdebug;
int timeout = 900; /* timeout after 15 minutes of inactivity */
int maxtimeout = 7200;/* don't allow idle time to be set beyond 2 hours */
@@ -1349,6 +1350,7 @@ pass(char *passwd)
#ifdef USE_PAM
int e;
#endif
+ char *chrootdir;
char *residue = NULL;
char *xpasswd;
@@ -1471,50 +1473,79 @@ skip:
|| login_getcapbool(lc, "ftp-chroot", 0)
#endif
;
- if (guest) {
+ chrootdir = NULL;
+ /*
+ * For a chrooted local user,
+ * a) see whether ftpchroot(5) specifies a chroot directory,
+ * b) extract the directory pathname from the line,
+ * c) expand it to the absolute pathname if necessary.
+ */
+ if (dochroot && residue &&
+ (chrootdir = strtok(residue, " \t")) != NULL &&
+ chrootdir[0] != '/') {
+ asprintf(&chrootdir, "%s/%s", pw->pw_dir, chrootdir);
+ if (chrootdir == NULL)
+ fatalerror("Ran out of memory.");
+
+ }
+ if (guest || dochroot) {
/*
- * We MUST do a chdir() after the chroot. Otherwise
- * the old current directory will be accessible as "."
- * outside the new root!
+ * If no chroot directory set yet, use the login directory.
+ * Copy it so it can be modified while pw->pw_dir stays intact.
*/
- if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
- reply(550, "Can't set guest privileges.");
- goto bad;
- }
- } else if (dochroot) {
- char *chrootdir = NULL;
-
- if (residue &&
- (chrootdir = strtok(residue, " \t")) != NULL &&
- chrootdir[0] != '/') {
- asprintf(&chrootdir, "%s/%s", pw->pw_dir, chrootdir);
- if (chrootdir == NULL)
+ if (chrootdir == NULL &&
+ (chrootdir = strdup(pw->pw_dir)) == NULL)
+ fatalerror("Ran out of memory.");
+ /*
+ * Check for the "/chroot/./home" syntax,
+ * separate the chroot and home directory pathnames.
+ */
+ if ((homedir = strstr(chrootdir, "/./")) != NULL) {
+ *(homedir++) = '\0'; /* wipe '/' */
+ homedir++; /* skip '.' */
+ /* so chrootdir can be freed later */
+ if ((homedir = strdup(homedir)) == NULL)
fatalerror("Ran out of memory.");
- free(residue);
- residue = chrootdir;
+ } else {
+ /*
+ * We MUST do a chdir() after the chroot. Otherwise
+ * the old current directory will be accessible as "."
+ * outside the new root!
+ */
+ homedir = "/";
}
- if (chrootdir == NULL)
- chrootdir = pw->pw_dir;
- if (chroot(chrootdir) < 0 || chdir("/") < 0) {
+ /*
+ * Finally, do chroot()
+ */
+ if (chroot(chrootdir) < 0) {
reply(550, "Can't change root.");
- if (residue)
- free(residue);
goto bad;
}
- if (residue)
- free(residue);
- } else if (chdir(pw->pw_dir) < 0) {
- if (chdir("/") < 0) {
- reply(530, "User %s: can't change directory to %s.",
- pw->pw_name, pw->pw_dir);
- goto bad;
- } else
- lreply(230, "No directory! Logging in with home=/");
- }
+ } else /* real user w/o chroot */
+ homedir = pw->pw_dir;
+ /*
+ * Set euid *before* doing chdir() so
+ * a) the user won't be carried to a directory that he couldn't reach
+ * on his own due to no permission to upper path components,
+ * b) NFS mounted homedirs w/restrictive permissions will be accessible
+ * (uid 0 has no root power over NFS if not mapped explicitly.)
+ */
if (seteuid((uid_t)pw->pw_uid) < 0) {
reply(550, "Can't set uid.");
goto bad;
}
+ if (chdir(homedir) < 0) {
+ if (guest || dochroot) {
+ reply(550, "Can't change to base directory.");
+ goto bad;
+ } else {
+ if (chdir("/") < 0) {
+ reply(550, "Root is inaccessible.");
+ goto bad;
+ }
+ lreply(230, "No directory! Logging in with home=/");
+ }
+ }
/*
* Display a login message, if it exists.
@@ -1577,12 +1608,20 @@ skip:
#ifdef LOGIN_CAP
login_close(lc);
#endif
+ if (chrootdir)
+ free(chrootdir);
+ if (residue)
+ free(residue);
return;
bad:
/* Forget all about it... */
#ifdef LOGIN_CAP
login_close(lc);
#endif
+ if (chrootdir)
+ free(chrootdir);
+ if (residue)
+ free(residue);
end_login();
}
OpenPOWER on IntegriCloud