2 * Copyright (c) 2004-2005 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
24 #include <sys/socket.h>
33 #endif /* STDC_HEADERS */
37 # ifdef HAVE_STRINGS_H
40 #endif /* HAVE_STRING_H */
43 #endif /* HAVE_UNISTD_H */
47 # include "emul/err.h"
48 #endif /* HAVE_ERR_H */
55 #if TIME_WITH_SYS_TIME
59 # include <emul/timespec.h>
65 __unused static const char rcsid[] = "$Sudo: sudo_edit.c,v 1.6.2.9 2008/06/21 00:47:52 millert Exp $";
68 extern sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
69 extern char **environ;
72 * Wrapper to allow users to edit privileged files with their own uid.
74 int sudo_edit(argc, argv, envp)
79 ssize_t nread, nwritten;
82 char **nargv, **ap, *editor, *cp;
84 int error, i, ac, ofd, tfd, nargc, rval, tmplen, wasblank;
87 struct timespec ts1, ts2;
91 struct timespec omtim;
96 * Find our temporary directory, one of /var/tmp, /usr/tmp, or /tmp
98 if (stat(_PATH_VARTMP, &sb) == 0 && S_ISDIR(sb.st_mode))
99 tmpdir = _PATH_VARTMP;
101 else if (stat(_PATH_USRTMP, &sb) == 0 && S_ISDIR(sb.st_mode))
102 tmpdir = _PATH_USRTMP;
106 tmplen = strlen(tmpdir);
107 while (tmplen > 0 && tmpdir[tmplen - 1] == '/')
111 * For each file specified by the user, make a temporary version
112 * and copy the contents of the original to it.
114 tf = emalloc2(argc - 1, sizeof(*tf));
115 memset(tf, 0, (argc - 1) * sizeof(*tf));
116 for (i = 0, ap = argv + 1; i < argc - 1 && *ap != NULL; i++, ap++) {
118 set_perms(PERM_RUNAS);
121 * We close the password file before we try to open the user-specified
122 * path to prevent the opening of things like /dev/fd/4.
125 if ((ofd = open(*ap, O_RDONLY, 0644)) != -1 || errno == ENOENT) {
127 memset(&sb, 0, sizeof(sb)); /* new file */
131 error = fstat(ofd, &sb);
133 error = stat(tf[i].ofile, &sb);
137 set_perms(PERM_ROOT);
138 if (error || (ofd != -1 && !S_ISREG(sb.st_mode))) {
142 warnx("%s: not a regular file", *ap);
150 tf[i].omtim.tv_sec = mtim_getsec(sb);
151 tf[i].omtim.tv_nsec = mtim_getnsec(sb);
152 tf[i].osize = sb.st_size;
153 if ((cp = strrchr(tf[i].ofile, '/')) != NULL)
157 easprintf(&tf[i].tfile, "%.*s/%s.XXXXXXXX", tmplen, tmpdir, cp);
158 set_perms(PERM_USER);
159 tfd = mkstemp(tf[i].tfile);
160 set_perms(PERM_ROOT);
166 while ((nread = read(ofd, buf, sizeof(buf))) != 0) {
167 if ((nwritten = write(tfd, buf, nread)) != nread) {
169 warn("%s", tf[i].tfile);
171 warnx("%s: short write", tf[i].tfile);
179 * If we are unable to set the mtime on the temp file to the value
180 * of the original file just make the stashed mtime match the temp
181 * file's mtime. It is better than nothing and we only use the info
182 * to determine whether or not a file has been modified.
184 if (touch(tfd, NULL, &tf[i].omtim) == -1) {
185 if (fstat(tfd, &sb) == 0) {
186 tf[i].omtim.tv_sec = mtim_getsec(sb);
187 tf[i].omtim.tv_nsec = mtim_getnsec(sb);
189 /* XXX - else error? */
195 return(1); /* no files readable, you lose */
198 * Determine which editor to use. We don't bother restricting this
199 * based on def_env_editor or def_editor since the editor runs with
200 * the uid of the invoking user, not the runas (privileged) user.
203 if (((editor = getenv("VISUAL")) != NULL && *editor != '\0') ||
204 ((editor = getenv("EDITOR")) != NULL && *editor != '\0')) {
205 editor = estrdup(editor);
207 editor = estrdup(def_editor);
208 if ((cp = strchr(editor, ':')) != NULL)
209 *cp = '\0'; /* def_editor could be a path */
213 * Allocate space for the new argument vector and fill it in.
214 * The EDITOR and VISUAL environment variables may contain command
215 * line args so look for those and alloc space for them too.
218 for (wasblank = FALSE, cp = editor; *cp != '\0'; cp++) {
219 if (isblank((unsigned char) *cp))
226 nargv = (char **) emalloc2(nargc + 1, sizeof(char *));
228 for ((cp = strtok(editor, " \t")); cp != NULL; (cp = strtok(NULL, " \t")))
230 for (i = 0; i < argc - 1 && ac < nargc; )
231 nargv[ac++] = tf[i++].tfile;
234 /* Allow the editor to be suspended. */
235 sigemptyset(&sa.sa_mask);
236 sa.sa_flags = SA_RESTART;
237 sa.sa_handler = SIG_DFL;
238 (void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
241 * Fork and exec the editor with the invoking user's creds,
242 * keeping track of the time spent in the editor.
249 } else if (kidpid == 0) {
251 (void) sigaction(SIGINT, &saved_sa_int, NULL);
252 (void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
253 set_perms(PERM_FULL_USER);
256 closefrom(STDERR_FILENO + 1);
257 execvp(nargv[0], nargv);
258 warn("unable to execute %s", nargv[0]);
263 * Wait for status from the child. Most modern kernels
264 * will not let an unprivileged child process send a
265 * signal to its privileged parent so we have to request
266 * status when the child is stopped and then send the
267 * same signal to our own pid.
271 pid = sudo_waitpid(kidpid, &i, WUNTRACED);
277 kill(getpid(), WSTOPSIG(i));
281 } while (pid != -1 || errno == EINTR);
283 if (pid == -1 || !WIFEXITED(i))
286 rval = WEXITSTATUS(i);
288 /* Copy contents of temp files to real ones */
289 for (i = 0; i < argc - 1; i++) {
291 set_perms(PERM_USER);
292 if ((tfd = open(tf[i].tfile, O_RDONLY, 0644)) != -1) {
294 error = fstat(tfd, &sb);
296 error = stat(tf[i].tfile, &sb);
299 set_perms(PERM_ROOT);
300 if (error || !S_ISREG(sb.st_mode)) {
302 warn("%s", tf[i].tfile);
304 warnx("%s: not a regular file", tf[i].tfile);
305 warnx("%s left unmodified", tf[i].ofile);
310 if (tf[i].osize == sb.st_size && tf[i].omtim.tv_sec == mtim_getsec(sb)
311 && tf[i].omtim.tv_nsec == mtim_getnsec(sb)) {
313 * If mtime and size match but the user spent no measurable
314 * time in the editor we can't tell if the file was changed.
316 #ifdef HAVE_TIMESPECSUB2
317 timespecsub(&ts1, &ts2);
319 timespecsub(&ts1, &ts2, &ts2);
321 if (timespecisset(&ts2)) {
322 warnx("%s unchanged", tf[i].ofile);
328 set_perms(PERM_RUNAS);
329 ofd = open(tf[i].ofile, O_WRONLY|O_TRUNC|O_CREAT, 0644);
330 set_perms(PERM_ROOT);
332 warn("unable to write to %s", tf[i].ofile);
333 warnx("contents of edit session left in %s", tf[i].tfile);
337 while ((nread = read(tfd, buf, sizeof(buf))) > 0) {
338 if ((nwritten = write(ofd, buf, nread)) != nread) {
340 warn("%s", tf[i].ofile);
342 warnx("%s: short write", tf[i].ofile);
347 /* success, got EOF */
349 } else if (nread < 0) {
350 warn("unable to read temporary file");
351 warnx("contents of edit session left in %s", tf[i].tfile);
353 warn("unable to write to %s", tf[i].ofile);
354 warnx("contents of edit session left in %s", tf[i].tfile);
361 /* Clean up temp files and return. */
362 for (i = 0; i < argc - 1; i++) {
363 if (tf[i].tfile != NULL)