2 * Copyright (c) 2004-2008 Todd C. Miller <Todd.Miller@courtesan.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <sys/types.h>
20 #include <sys/param.h>
24 #include <sys/socket.h>
33 #endif /* STDC_HEADERS */
37 # ifdef HAVE_STRINGS_H
40 #endif /* HAVE_STRING_H */
43 #endif /* HAVE_UNISTD_H */
49 #if TIME_WITH_SYS_TIME
53 # include <emul/timespec.h>
59 __unused static const char rcsid[] = "$Sudo: sudo_edit.c,v 1.39 2009/09/30 13:50:58 millert Exp $";
62 extern sigaction_t saved_sa_int, saved_sa_quit, saved_sa_tstp;
63 extern char **environ;
65 static char *find_editor();
68 * Wrapper to allow users to edit privileged files with their own uid.
71 sudo_edit(argc, argv, envp)
76 ssize_t nread, nwritten;
79 char **nargv, **ap, *editor, *cp;
81 int error, i, ac, ofd, tfd, nargc, rval, tmplen, wasblank;
83 struct timespec ts1, ts2;
87 struct timespec omtim;
92 * Find our temporary directory, one of /var/tmp, /usr/tmp, or /tmp
94 if (stat(_PATH_VARTMP, &sb) == 0 && S_ISDIR(sb.st_mode))
95 tmpdir = _PATH_VARTMP;
97 else if (stat(_PATH_USRTMP, &sb) == 0 && S_ISDIR(sb.st_mode))
98 tmpdir = _PATH_USRTMP;
102 tmplen = strlen(tmpdir);
103 while (tmplen > 0 && tmpdir[tmplen - 1] == '/')
107 * Close password, shadow, and group files before we try to open
108 * user-specified files to prevent the opening of things like /dev/fd/4
114 * For each file specified by the user, make a temporary version
115 * and copy the contents of the original to it.
117 tf = emalloc2(argc - 1, sizeof(*tf));
118 zero_bytes(tf, (argc - 1) * sizeof(*tf));
119 for (i = 0, ap = argv + 1; i < argc - 1 && *ap != NULL; i++, ap++) {
121 set_perms(PERM_RUNAS);
122 if ((ofd = open(*ap, O_RDONLY, 0644)) != -1 || errno == ENOENT) {
124 zero_bytes(&sb, sizeof(sb)); /* new file */
128 error = fstat(ofd, &sb);
130 error = stat(tf[i].ofile, &sb);
134 set_perms(PERM_ROOT);
135 if (error || (ofd != -1 && !S_ISREG(sb.st_mode))) {
139 warningx("%s: not a regular file", *ap);
147 tf[i].omtim.tv_sec = mtim_getsec(sb);
148 tf[i].omtim.tv_nsec = mtim_getnsec(sb);
149 tf[i].osize = sb.st_size;
150 if ((cp = strrchr(tf[i].ofile, '/')) != NULL)
154 easprintf(&tf[i].tfile, "%.*s/%s.XXXXXXXX", tmplen, tmpdir, cp);
155 set_perms(PERM_USER);
156 tfd = mkstemp(tf[i].tfile);
157 set_perms(PERM_ROOT);
163 while ((nread = read(ofd, buf, sizeof(buf))) != 0) {
164 if ((nwritten = write(tfd, buf, nread)) != nread) {
166 warning("%s", tf[i].tfile);
168 warningx("%s: short write", tf[i].tfile);
175 * We always update the stashed mtime because the time
176 * resolution of the filesystem the temporary file is on may
177 * not match that of the filesystem where the file to be edited
178 * resides. It is OK if touch() fails since we only use the info
179 * to determine whether or not a file has been modified.
181 (void) touch(tfd, NULL, &tf[i].omtim);
183 error = fstat(tfd, &sb);
185 error = stat(tf[i].tfile, &sb);
188 tf[i].omtim.tv_sec = mtim_getsec(sb);
189 tf[i].omtim.tv_nsec = mtim_getnsec(sb);
194 return(1); /* no files readable, you lose */
197 editor = find_editor();
200 * Allocate space for the new argument vector and fill it in.
201 * The EDITOR and VISUAL environment variables may contain command
202 * line args so look for those and alloc space for them too.
205 for (wasblank = FALSE, cp = editor; *cp != '\0'; cp++) {
206 if (isblank((unsigned char) *cp))
213 nargv = (char **) emalloc2(nargc + 1, sizeof(char *));
215 for ((cp = strtok(editor, " \t")); cp != NULL; (cp = strtok(NULL, " \t")))
217 for (i = 0; i < argc - 1 && ac < nargc; )
218 nargv[ac++] = tf[i++].tfile;
221 /* Allow the editor to be suspended. */
222 (void) sigaction(SIGTSTP, &saved_sa_tstp, NULL);
225 * Fork and exec the editor with the invoking user's creds,
226 * keeping track of the time spent in the editor.
233 } else if (kidpid == 0) {
235 (void) sigaction(SIGINT, &saved_sa_int, NULL);
236 (void) sigaction(SIGQUIT, &saved_sa_quit, NULL);
237 set_perms(PERM_FULL_USER);
238 closefrom(def_closefrom);
239 execvp(nargv[0], nargv);
240 warning("unable to execute %s", nargv[0]);
245 * Wait for status from the child. Most modern kernels
246 * will not let an unprivileged child process send a
247 * signal to its privileged parent so we have to request
248 * status when the child is stopped and then send the
249 * same signal to our own pid.
253 pid = sudo_waitpid(kidpid, &i, WUNTRACED);
259 kill(getpid(), WSTOPSIG(i));
263 } while (pid != -1 || errno == EINTR);
265 if (pid == -1 || !WIFEXITED(i))
268 rval = WEXITSTATUS(i);
270 /* Copy contents of temp files to real ones */
271 for (i = 0; i < argc - 1; i++) {
273 set_perms(PERM_USER);
274 if ((tfd = open(tf[i].tfile, O_RDONLY, 0644)) != -1) {
276 error = fstat(tfd, &sb);
278 error = stat(tf[i].tfile, &sb);
281 set_perms(PERM_ROOT);
282 if (error || !S_ISREG(sb.st_mode)) {
284 warning("%s", tf[i].tfile);
286 warningx("%s: not a regular file", tf[i].tfile);
287 warningx("%s left unmodified", tf[i].ofile);
292 if (tf[i].osize == sb.st_size && tf[i].omtim.tv_sec == mtim_getsec(sb)
293 && tf[i].omtim.tv_nsec == mtim_getnsec(sb)) {
295 * If mtime and size match but the user spent no measurable
296 * time in the editor we can't tell if the file was changed.
298 #ifdef HAVE_TIMESPECSUB2
299 timespecsub(&ts1, &ts2);
301 timespecsub(&ts1, &ts2, &ts2);
303 if (timespecisset(&ts2)) {
304 warningx("%s unchanged", tf[i].ofile);
310 set_perms(PERM_RUNAS);
311 ofd = open(tf[i].ofile, O_WRONLY|O_TRUNC|O_CREAT, 0644);
312 set_perms(PERM_ROOT);
314 warning("unable to write to %s", tf[i].ofile);
315 warningx("contents of edit session left in %s", tf[i].tfile);
319 while ((nread = read(tfd, buf, sizeof(buf))) > 0) {
320 if ((nwritten = write(ofd, buf, nread)) != nread) {
322 warning("%s", tf[i].ofile);
324 warningx("%s: short write", tf[i].ofile);
329 /* success, got EOF */
331 } else if (nread < 0) {
332 warning("unable to read temporary file");
333 warningx("contents of edit session left in %s", tf[i].tfile);
335 warning("unable to write to %s", tf[i].ofile);
336 warningx("contents of edit session left in %s", tf[i].tfile);
343 /* Clean up temp files and return. */
344 for (i = 0; i < argc - 1; i++) {
345 if (tf[i].tfile != NULL)
352 * Determine which editor to use. We don't bother restricting this
353 * based on def_env_editor or def_editor since the editor runs with
354 * the uid of the invoking user, not the runas (privileged) user.
359 char *cp, *editor = NULL, **ev, *ev0[4];
361 ev0[0] = "SUDO_EDITOR";
365 for (ev = ev0; *ev != NULL; ev++) {
366 if ((editor = getenv(*ev)) != NULL && *editor != '\0') {
367 if ((cp = strrchr(editor, '/')) != NULL)
371 /* Ignore "sudoedit" and "sudo" to avoid an endless loop. */
372 if (strncmp(cp, "sudo", 4) != 0 ||
373 (cp[4] != ' ' && cp[4] != '\0' && strcmp(cp + 4, "edit") != 0)) {
374 editor = estrdup(editor);
380 if (editor == NULL) {
381 editor = estrdup(def_editor);
382 if ((cp = strchr(editor, ':')) != NULL)
383 *cp = '\0'; /* def_editor could be a path */