diff options
Diffstat (limited to 'contrib/sendmail/smrsh')
| -rw-r--r-- | contrib/sendmail/smrsh/Makefile | 17 | ||||
| -rw-r--r-- | contrib/sendmail/smrsh/Makefile.m4 | 21 | ||||
| -rw-r--r-- | contrib/sendmail/smrsh/README | 156 | ||||
| -rw-r--r-- | contrib/sendmail/smrsh/smrsh.8 | 88 | ||||
| -rw-r--r-- | contrib/sendmail/smrsh/smrsh.c | 436 |
5 files changed, 0 insertions, 718 deletions
diff --git a/contrib/sendmail/smrsh/Makefile b/contrib/sendmail/smrsh/Makefile deleted file mode 100644 index a9c4af7a2a99..000000000000 --- a/contrib/sendmail/smrsh/Makefile +++ /dev/null @@ -1,17 +0,0 @@ -# $Id: Makefile,v 8.5 1999/09/23 22:36:43 ca Exp $ - -SHELL= /bin/sh -BUILD= ./Build -OPTIONS= $(CONFIG) $(FLAGS) - -all: FRC - $(SHELL) $(BUILD) $(OPTIONS) $@ -clean: FRC - $(SHELL) $(BUILD) $(OPTIONS) $@ -install: FRC - $(SHELL) $(BUILD) $(OPTIONS) $@ - -fresh: FRC - $(SHELL) $(BUILD) $(OPTIONS) -c - -FRC: diff --git a/contrib/sendmail/smrsh/Makefile.m4 b/contrib/sendmail/smrsh/Makefile.m4 deleted file mode 100644 index f090250ff185..000000000000 --- a/contrib/sendmail/smrsh/Makefile.m4 +++ /dev/null @@ -1,21 +0,0 @@ -dnl $Id: Makefile.m4,v 8.34.2.1 2002/06/21 21:58:48 ca Exp $ -include(confBUILDTOOLSDIR`/M4/switch.m4') - -define(`confREQUIRE_LIBSM', `true') -# sendmail dir -SMSRCDIR= ifdef(`confSMSRCDIR', `confSMSRCDIR', `${SRCDIR}/sendmail') -PREPENDDEF(`confENVDEF', `confMAPDEF') -PREPENDDEF(`confINCDIRS', `-I${SMSRCDIR} ') - -bldPRODUCT_START(`executable', `smrsh') -define(`bldINSTALL_DIR', `E') -define(`bldSOURCES', `smrsh.c ') -bldPUSH_SMLIB(`sm') -APPENDDEF(`confENVDEF', `-DNOT_SENDMAIL') -bldPRODUCT_END - -bldPRODUCT_START(`manpage', `smrsh') -define(`bldSOURCES', `smrsh.8') -bldPRODUCT_END - -bldFINISH diff --git a/contrib/sendmail/smrsh/README b/contrib/sendmail/smrsh/README deleted file mode 100644 index 7e22f86bd8f5..000000000000 --- a/contrib/sendmail/smrsh/README +++ /dev/null @@ -1,156 +0,0 @@ - -README smrsh - sendmail restricted shell. - -This README file is provided as a courtesy of the CERT Coordination Center, -Software Engineering Institute, Carnegie Mellon University. This file is -intended as a supplement to the CERT advisory CA-93:16.sendmail.vulnerability, -and to the software, smrsh.c, written by Eric Allman. - - - -The smrsh(8) program is intended as a replacement for /bin/sh in the -program mailer definition of sendmail(8). This README file describes -the steps needed to compile and install smrsh. - -smrsh is a restricted shell utility that provides the ability to -specify, through a configuration, an explicit list of executable -programs. When used in conjunction with sendmail, smrsh effectively -limits sendmail's scope of program execution to only those programs -specified in smrsh's configuration. - -smrsh has been written with portability in mind, and uses traditional -Unix library utilities. As such, smrsh should compile on most -Unix C compilers. - -smrsh should build on most systems with the enclosed Build script: - - host.domain% sh Build - -To compile smrsh.c by hand, use the following command: - - host.domain% cc -o smrsh smrsh.c - -For machines that provide dynamic linking, it is advisable to compile -smrsh without dynamic linking. As an example with the Sun Microsystems -compiler, you should compile with the -Bstatic option. - - host.domain% cc -Bstatic -o smrsh smrsh.c - or - host.domain% sh Build LDOPTS=-Bstatic - -With gcc, the GNU C compiler, use the -static option. - - host.domain% cc -static -o smrsh smrsh.c - or - host.domain% sh Build LDOPTS=-static - - - -As root, install smrsh in /usr/libexec. Using the Build script: - - host.domain# sh Build install - -For manual installation: install smrsh in the /usr/libexec -directory, with mode 511. - - host.domain# mv smrsh /usr/libexec - host.domain# chmod 511 /usr/libexec/smrsh - - - -Next, determine the list of commands that smrsh should allow sendmail -to run. This list of allowable commands can be determined by: - - 1. examining your /etc/mail/aliases file, to indicate what commands - are being used by the system. - - 2. surveying your host's .forward files, to determine what - commands users have specified. - -See the man page for aliases(5) if you are unfamiliar with the format of -these specifications. Additionally, you should include in the list, -popular commands such as /usr/ucb/vacation. - -You should NOT include interpreter programs such as sh(1), csh(1), -perl(1), uudecode(1) or the stream editor sed(1) in your list of -acceptable commands. - -If your platform doesn't have a default SMRSH_CMDDIR setting, you will -next need to create the directory /usr/adm/sm.bin and populate -it with the programs that your site feels are allowable for sendmail -to execute. This directory is explicitly specified in the source -code for smrsh, so changing this directory must be accompanied with -a change in smrsh.c. - - -You will have to be root to make these modifications. - -After creating the /usr/adm/sm.bin directory, either copy the programs -to the directory, or establish links to the allowable programs from -/usr/adm/sm.bin. Change the file permissions, so that these programs -can not be modified by non-root users. If you use links, you should -ensure that the target programs are not modifiable. - -To allow the popular vacation(1) program by creating a link in the -/usr/adm/sm.bin directory, you should: - - host.domain# cd /usr/adm/sm.bin - host.domain# ln -s /usr/ucb/vacation vacation - - - - -After populating the /usr/adm/sm.bin directory, you can now configure -sendmail to use the restricted shell. Save the current sendmail.cf -file prior to modifying it, as a prudent precaution. - -Typically, the program mailer is defined by a single line in the -sendmail configuration file, sendmail.cf. This file is traditionally -found in the /etc, /usr/lib or /etc/mail directories, depending on -the UNIX vendor. - -If you are unsure of the location of the actual sendmail configuration -file, a search of the strings(1) output of the sendmail binary, will -help to locate it. - -In order to configure sendmail to use smrsh, you must modify the Mprog -definition in the sendmail.cf file, by replacing the /bin/sh specification -with /usr/libexec/smrsh. - -As an example: - -In most Sun Microsystems' sendmail.cf files, the line is: -Mprog, P=/bin/sh, F=lsDFMeuP, S=10, R=20, A=sh -c $u - -which should be changed to: -Mprog, P=/usr/libexec/smrsh, F=lsDFMeuP, S=10, R=20, A=sh -c $u - ^^^^^^^^^^^^^^^^^^ - -A more generic line may be: -Mprog, P=/bin/sh, F=lsDFM, A=sh -c $u - -and should be changed to; -Mprog, P=/usr/libexec/smrsh, F=lsDFM, A=sh -c $u - - -After modifying the Mprog definition in the sendmail.cf file, if a frozen -configuration file is being used, it is essential to create a new one. -You can determine if you need a frozen configuration by discovering -if a sendmail.fc file currently exists in either the /etc/, /usr/lib, -or /etc/mail directories. The specific location can be determined using -a search of the strings(1) output of the sendmail binary. - -In order to create a new frozen configuration, if it is required: - host.domain# /usr/lib/sendmail -bz - -Now re-start the sendmail process. An example of how to do this on -a typical system follows: - - host.domain# cat /var/run/sendmail.pid - 130 - /usr/sbin/sendmail -bd -q30m - host.domain# /bin/kill -15 130 - host.domain# /usr/sbin/sendmail -bd -q30m - - -$Revision: 8.8 $, Last updated $Date: 2001/01/24 00:05:58 $ diff --git a/contrib/sendmail/smrsh/smrsh.8 b/contrib/sendmail/smrsh/smrsh.8 deleted file mode 100644 index 1f3c0a27634f..000000000000 --- a/contrib/sendmail/smrsh/smrsh.8 +++ /dev/null @@ -1,88 +0,0 @@ -.\" Copyright (c) 1998-2001 Sendmail, Inc. and its suppliers. -.\" All rights reserved. -.\" Copyright (c) 1993 Eric P. Allman. All rights reserved. -.\" Copyright (c) 1993 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" By using this file, you agree to the terms and conditions set -.\" forth in the LICENSE file which can be found at the top level of -.\" the sendmail distribution. -.\" -.\" -.\" $Id: smrsh.8,v 8.16 2002/04/25 13:33:40 ca Exp $ -.\" -.TH SMRSH 8 "$Date: 2002/04/25 13:33:40 $" -.SH NAME -smrsh \- restricted shell for sendmail -.SH SYNOPSIS -.B smrsh -.B \-c -command -.SH DESCRIPTION -The -.I smrsh -program is intended as a replacement for -.I sh -for use in the ``prog'' mailer in -.IR sendmail (8) -configuration files. -It sharply limits the commands that can be run using the -``|program'' syntax of -.I sendmail -in order to improve the over all security of your system. -Briefly, even if a ``bad guy'' can get sendmail to run a program -without going through an alias or forward file, -.I smrsh -limits the set of programs that he or she can execute. -.PP -Briefly, -.I smrsh -limits programs to be in a single directory, -by default -/usr/adm/sm.bin, -allowing the system administrator to choose the set of acceptable commands, -and to the shell builtin commands ``exec'', ``exit'', and ``echo''. -It also rejects any commands with the characters -`\`', `<', `>', `;', `$', `(', `)', `\er' (carriage return), -or `\en' (newline) -on the command line to prevent ``end run'' attacks. -It allows ``||'' and ``&&'' to enable commands like: -``"|exec /usr/local/bin/procmail -f- /etc/procmailrcs/user || exit 75"'' -.PP -Initial pathnames on programs are stripped, -so forwarding to ``/usr/ucb/vacation'', -``/usr/bin/vacation'', -``/home/server/mydir/bin/vacation'', -and -``vacation'' -all actually forward to -``/usr/adm/sm.bin/vacation''. -.PP -System administrators should be conservative about populating -the sm.bin directory. -Reasonable additions are -.IR vacation (1), -.IR procmail (1), -and the like. -No matter how brow-beaten you may be, -never include any shell or shell-like program -(such as -.IR perl (1)) -in the -sm.bin -directory. -Note that this does not restrict the use of shell or perl scripts -in the sm.bin directory (using the ``#!'' syntax); -it simply disallows execution of arbitrary programs. -.SH COMPILATION -Compilation should be trivial on most systems. -You may need to use \-DSMRSH_PATH=\e"\fIpath\fP\e" -to adjust the default search path -(defaults to ``/bin:/usr/bin:/usr/ucb'') -and/or \-DSMRSH_CMDDIR=\e"\fIdir\fP\e" -to change the default program directory -(defaults to ``/usr/adm/sm.bin''). -.SH FILES -/usr/adm/sm.bin \- directory for restricted programs -.SH SEE ALSO -sendmail(8) diff --git a/contrib/sendmail/smrsh/smrsh.c b/contrib/sendmail/smrsh/smrsh.c deleted file mode 100644 index 9a9bc213a449..000000000000 --- a/contrib/sendmail/smrsh/smrsh.c +++ /dev/null @@ -1,436 +0,0 @@ -/* - * Copyright (c) 1998-2002 Sendmail, Inc. and its suppliers. - * All rights reserved. - * Copyright (c) 1993 Eric P. Allman. All rights reserved. - * Copyright (c) 1993 - * The Regents of the University of California. All rights reserved. - * - * By using this file, you agree to the terms and conditions set - * forth in the LICENSE file which can be found at the top level of - * the sendmail distribution. - * - */ - -#include <sm/gen.h> - -SM_IDSTR(copyright, -"@(#) Copyright (c) 1998-2001 Sendmail, Inc. and its suppliers.\n\ - All rights reserved.\n\ - Copyright (c) 1993 Eric P. Allman. All rights reserved.\n\ - Copyright (c) 1993\n\ - The Regents of the University of California. All rights reserved.\n") - -SM_IDSTR(id, "@(#)$Id: smrsh.c,v 8.58.2.2 2002/09/24 21:40:05 ca Exp $") - -/* -** SMRSH -- sendmail restricted shell -** -** This is a patch to get around the prog mailer bugs in most -** versions of sendmail. -** -** Use this in place of /bin/sh in the "prog" mailer definition -** in your sendmail.cf file. You then create CMDDIR (owned by -** root, mode 755) and put links to any programs you want -** available to prog mailers in that directory. This should -** include things like "vacation" and "procmail", but not "sed" -** or "sh". -** -** Leading pathnames are stripped from program names so that -** existing .forward files that reference things like -** "/usr/bin/vacation" will continue to work. -** -** The following characters are completely illegal: -** < > ^ & ` ( ) \n \r -** The following characters are sometimes illegal: -** | & -** This is more restrictive than strictly necessary. -** -** To use this, add FEATURE(`smrsh') to your .mc file. -** -** This can be used on any version of sendmail. -** -** In loving memory of RTM. 11/02/93. -*/ - -#include <unistd.h> -#include <sm/io.h> -#include <sm/limits.h> -#include <sm/string.h> -#include <sys/file.h> -#include <sys/types.h> -#include <sys/stat.h> -#include <string.h> -#include <ctype.h> -#include <errno.h> -#ifdef EX_OK -# undef EX_OK -#endif /* EX_OK */ -#include <sysexits.h> -#include <syslog.h> -#include <stdlib.h> - -#include <sm/conf.h> -#include <sm/errstring.h> - -/* directory in which all commands must reside */ -#ifndef CMDDIR -# ifdef SMRSH_CMDDIR -# define CMDDIR SMRSH_CMDDIR -# else /* SMRSH_CMDDIR */ -# define CMDDIR "/usr/adm/sm.bin" -# endif /* SMRSH_CMDDIR */ -#endif /* ! CMDDIR */ - -/* characters disallowed in the shell "-c" argument */ -#define SPECIALS "<|>^();&`$\r\n" - -/* default search path */ -#ifndef PATH -# ifdef SMRSH_PATH -# define PATH SMRSH_PATH -# else /* SMRSH_PATH */ -# define PATH "/bin:/usr/bin:/usr/ucb" -# endif /* SMRSH_PATH */ -#endif /* ! PATH */ - -char newcmdbuf[1000]; -char *prg, *par; - -/* -** ADDCMD -- add a string to newcmdbuf, check for overflow -** -** Parameters: -** s -- string to add -** cmd -- it's a command: prepend CMDDIR/ -** len -- length of string to add -** -** Side Effects: -** changes newcmdbuf or exits with a failure. -** -*/ - -void -addcmd(s, cmd, len) - char *s; - bool cmd; - size_t len; -{ - if (s == NULL || *s == '\0') - return; - - if (sizeof newcmdbuf - strlen(newcmdbuf) <= - len + (cmd ? (strlen(CMDDIR) + 1) : 0)) - { - (void)sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: command too long: %s\n", prg, par); -#ifndef DEBUG - syslog(LOG_WARNING, "command too long: %.40s", par); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - if (cmd) - (void) sm_strlcat2(newcmdbuf, CMDDIR, "/", sizeof newcmdbuf); - (void) sm_strlcat(newcmdbuf, s, sizeof newcmdbuf); -} - -int -main(argc, argv) - int argc; - char **argv; -{ - register char *p; - register char *q; - register char *r; - register char *cmd; - int isexec; - int save_errno; - char *newenv[2]; - char pathbuf[1000]; - char specialbuf[32]; - struct stat st; - -#ifndef DEBUG -# ifndef LOG_MAIL - openlog("smrsh", 0); -# else /* ! LOG_MAIL */ - openlog("smrsh", LOG_ODELAY|LOG_CONS, LOG_MAIL); -# endif /* ! LOG_MAIL */ -#endif /* ! DEBUG */ - - (void) sm_strlcpyn(pathbuf, sizeof pathbuf, 2, "PATH=", PATH); - newenv[0] = pathbuf; - newenv[1] = NULL; - - /* - ** Do basic argv usage checking - */ - - prg = argv[0]; - - if (argc != 3 || strcmp(argv[1], "-c") != 0) - { - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "Usage: %s -c command\n", prg); -#ifndef DEBUG - syslog(LOG_ERR, "usage"); -#endif /* ! DEBUG */ - exit(EX_USAGE); - } - - par = argv[2]; - - /* - ** Disallow special shell syntax. This is overly restrictive, - ** but it should shut down all attacks. - ** Be sure to include 8-bit versions, since many shells strip - ** the address to 7 bits before checking. - */ - - if (strlen(SPECIALS) * 2 >= sizeof specialbuf) - { -#ifndef DEBUG - syslog(LOG_ERR, "too many specials: %.40s", SPECIALS); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - (void) sm_strlcpy(specialbuf, SPECIALS, sizeof specialbuf); - for (p = specialbuf; *p != '\0'; p++) - *p |= '\200'; - (void) sm_strlcat(specialbuf, SPECIALS, sizeof specialbuf); - - /* - ** Do a quick sanity check on command line length. - */ - - if (strlen(par) > (sizeof newcmdbuf - sizeof CMDDIR - 2)) - { - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: command too long: %s\n", prg, par); -#ifndef DEBUG - syslog(LOG_WARNING, "command too long: %.40s", par); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - - q = par; - newcmdbuf[0] = '\0'; - isexec = false; - - while (*q != '\0') - { - /* - ** Strip off a leading pathname on the command name. For - ** example, change /usr/ucb/vacation to vacation. - */ - - /* strip leading spaces */ - while (*q != '\0' && isascii(*q) && isspace(*q)) - q++; - if (*q == '\0') - { - if (isexec) - { - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: missing command to exec\n", - prg); -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: missing command to exec", (int) getuid()); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - break; - } - - /* find the end of the command name */ - p = strpbrk(q, " \t"); - if (p == NULL) - cmd = &q[strlen(q)]; - else - { - *p = '\0'; - cmd = p; - } - /* search backwards for last / (allow for 0200 bit) */ - while (cmd > q) - { - if ((*--cmd & 0177) == '/') - { - cmd++; - break; - } - } - /* cmd now points at final component of path name */ - - /* allow a few shell builtins */ - if (strcmp(q, "exec") == 0 && p != NULL) - { - addcmd("exec ", false, strlen("exec ")); - - /* test _next_ arg */ - q = ++p; - isexec = true; - continue; - } - else if (strcmp(q, "exit") == 0 || strcmp(q, "echo") == 0) - { - addcmd(cmd, false, strlen(cmd)); - - /* test following chars */ - } - else - { - char cmdbuf[MAXPATHLEN]; - - /* - ** Check to see if the command name is legal. - */ - - if (sm_strlcpyn(cmdbuf, sizeof cmdbuf, 3, CMDDIR, - "/", cmd) >= sizeof cmdbuf) - { - /* too long */ - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: \"%s\" not available for sendmail programs (filename too long)\n", - prg, cmd); - if (p != NULL) - *p = ' '; -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: attempt to use \"%s\" (filename too long)", - (int) getuid(), cmd); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - -#ifdef DEBUG - (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, - "Trying %s\n", cmdbuf); -#endif /* DEBUG */ - if (stat(cmdbuf, &st) < 0) - { - /* can't stat it */ - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: \"%s\" not available for sendmail programs (stat failed)\n", - prg, cmd); - if (p != NULL) - *p = ' '; -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: attempt to use \"%s\" (stat failed)", - (int) getuid(), cmd); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - if (!S_ISREG(st.st_mode) -#ifdef S_ISLNK - && !S_ISLNK(st.st_mode) -#endif /* S_ISLNK */ - ) - { - /* can't stat it */ - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: \"%s\" not available for sendmail programs (not a file)\n", - prg, cmd); - if (p != NULL) - *p = ' '; -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: attempt to use \"%s\" (not a file)", - (int) getuid(), cmd); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - if (access(cmdbuf, X_OK) < 0) - { - /* oops.... crack attack possiblity */ - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: \"%s\" not available for sendmail programs\n", - prg, cmd); - if (p != NULL) - *p = ' '; -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: attempt to use \"%s\"", - (int) getuid(), cmd); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - - /* - ** Create the actual shell input. - */ - - addcmd(cmd, true, strlen(cmd)); - } - isexec = false; - - if (p != NULL) - *p = ' '; - else - break; - - r = strpbrk(p, specialbuf); - if (r == NULL) - { - addcmd(p, false, strlen(p)); - break; - } -#if ALLOWSEMI - if (*r == ';') - { - addcmd(p, false, r - p + 1); - q = r + 1; - continue; - } -#endif /* ALLOWSEMI */ - if ((*r == '&' && *(r + 1) == '&') || - (*r == '|' && *(r + 1) == '|')) - { - addcmd(p, false, r - p + 2); - q = r + 2; - continue; - } - - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: cannot use %c in command\n", prg, *r); -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: attempt to use %c in command: %s", - (int) getuid(), *r, par); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - if (isexec) - { - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "%s: missing command to exec\n", prg); -#ifndef DEBUG - syslog(LOG_CRIT, "uid %d: missing command to exec", - (int) getuid()); -#endif /* ! DEBUG */ - exit(EX_UNAVAILABLE); - } - /* make sure we created something */ - if (newcmdbuf[0] == '\0') - { - (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT, - "Usage: %s -c command\n", prg); -#ifndef DEBUG - syslog(LOG_ERR, "usage"); -#endif /* ! DEBUG */ - exit(EX_USAGE); - } - - /* - ** Now invoke the shell - */ - -#ifdef DEBUG - (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s\n", newcmdbuf); -#endif /* DEBUG */ - (void) execle("/bin/sh", "/bin/sh", "-c", newcmdbuf, NULL, newenv); - save_errno = errno; -#ifndef DEBUG - syslog(LOG_CRIT, "Cannot exec /bin/sh: %s", sm_errstring(errno)); -#endif /* ! DEBUG */ - errno = save_errno; - sm_perror("/bin/sh"); - exit(EX_OSFILE); - /* NOTREACHED */ - return EX_OSFILE; -} |