`, on a task where `execinfo` is `show`, or read the policy with `chsr list`.
+- After a conversion or an upgrade, run a command of each critical task once.
diff --git a/book/src/cli/dosr.md b/book/src/cli/dosr.md
index 06d3108b..8837e01a 100644
--- a/book/src/cli/dosr.md
+++ b/book/src/cli/dosr.md
@@ -1,32 +1,179 @@
# `dosr`
-`dosr` executes commands through RaR policy checks.
+
+This section is AI-generated and reviewed by human.
+
-## Usage
+`dosr` (do switch role) runs a command with the privileges of one task of the policy, and nothing more. You do not become root: you get the user, the groups and the Linux capabilities that this task gives to this command.
-
-Execute privileged commands with a role-based access control system
+This chapter explains what `dosr` does when you run it, how it chooses a task, and what you can control from the command line. It follows the WebOps team of the [Configuration](../configuration.md) chapter: alice, bob and charly now use `dosr` every day.
-Usage: dosr [OPTIONS] [COMMAND]...
+## Usage
-Arguments:
- [COMMAND]... Command to execute
+
+Usage: dosr [OPTIONS] [--] [COMMAND]...
Options:
- -r, --role <ROLE> Role to select
- -t, --task <TASK> Task to select (--role required)
- -u, --user <USER> User to execute the command as
- -g, --group <GROUP<,GROUP...>> Group(s) to execute the command as
- -E, --preserve-env Keep environment variables from the current process
- -D, --chdir <DIR> Change working directory before executing the command
- -p, --prompt <PROMPT> Prompt to display
- -K Remove timestamp file
- -i, --info Print the execution context of a command if allowed by a matching task
- -h, --help Print help (see more with '--help')
- -V, --version Print version
+ -r, --role <ROLE> Role to use
+ -t, --task <TASK> Task to use in the selected role (--role required)
+ -u, --user <USER> User to execute the command as
+ -g, --group <GROUP>(,<GROUP>...) Group(s) to execute the command as
+ -E, --preserve-env Keep your environment variables, if a matching task allows it
+ -D, --chdir <DIR> Working directory of the command
+ -p, --prompt <PROMPT> Prompt to display instead of "Password: "
+ -S, --stdin Read the password from the standard input
+ -K, --remove-timestamp Remove your timestamp cookies before authentication
+ -i, --info Print the execution context of a command, if a matching task allows it
+ -h, --help Print help
+ -v, --version Print version
-If you're accustomed to utilizing the sudo tool and find it difficult to break that habit, consider creating an alias :
+## What happens when you run `dosr`
+
+Let's follow bob, who wants to read the last lines of the Caddy access log:
+
+```bash
+dosr tail -n 50 /var/log/caddy/access.log
+```
+
+1. **Options first.** `dosr` reads its own options until the first word that is not an option: this is the command. Everything after it belongs to the command, even when it starts with `-`. Here, `-n 50` is given to `tail`, not to `dosr`. Like with sudo, `--` also ends the options of `dosr`.
+2. **Finding the tasks.** `dosr` reads the policy, keeps the roles where bob is an actor, and looks for the tasks whose commands match `tail -n 50 /var/log/caddy/access.log`. `tail` is resolved with the `path` option of the policy, never with the current directory.
+3. **Authentication.** `dosr` asks for bob's password through PAM. It asks it even when no task matches: before bob is authenticated, `dosr` reveals nothing about the policy. Someone who stole bob's account cannot list what the policy allows without his password.
+4. **The decision.** If no task matches, `dosr` answers "You are not allowed to execute this command, this incident will be reported." and logs the attempt.
+5. **The execution context.** `dosr` prepares the user, the groups and the capabilities of the task, filters the environment, sets the working directory and the umask. If the task needs a capability that this session can never obtain, `dosr` stops here and tells which ones.
+6. **The execution.** `dosr` logs the execution, runs the command and waits for it. When the command ends, `dosr` ends the same way.
+
+
+dosr does not run a shell, like sudo does as well. When you are doing dosr echo hello > /etc/file, the redirection is done by your own shell, with your own privileges, before dosr even starts. So, you can use dosr sh -c 'echo hello > /etc/file' to run the redirection with the privileges of the task.
+
+
+## How `dosr` chooses a task
+
+A user may hold several roles, and several tasks may match the same command. In that case, `dosr` selects the most precise and least privileged task.
+
+The precision comes first. It is about how closely the policy matches you and your command: a command line written in full is more precise than a regular expression on the arguments, which is more precise than a task that accepts any arguments. Then, only when two tasks are equally precise, the one with fewer privileges wins: fewer capabilities, no change to root, and so on.
+
+Despite this selection, confusion can still arise. When two tasks are entirely equivalent but configure the command differently (for example with different environment variables), `dosr` cannot decide for you. It answers "Permission denied", and logs a warning saying that the policy must be fixed.
+
+When you know which task you want, say it:
+
+```bash
+dosr -r caddy-audit -t read-logs tail -n 50 /var/log/caddy/access.log
+```
+
+This is the best practice in automation (Ansible, scripts): the selection is then deterministic, and a change in the policy cannot make your script use another task without you noticing.
+
+## Choosing the user and the groups: `-u` and `-g`
+
+By default, the task decides who the command runs as. With `-u` and `-g`, you ask for a specific user or group, but only among those that the task allows (see the [selector forms](../configuration.md#selector-forms)). A task that does not allow your request is not selected:
+
+```bash
+# Only accepted by a task whose setgid selector allows www-data
+dosr -g www-data /usr/local/bin/caddy-probe
+```
+
+`-u` and `-g` do not give you a user: they choose one within the policy.
+
+When the task changes the user and gives no groups, the command gets the groups of that user, its primary group and its supplementary groups, as a login gives them. It never mixes the new user with your own groups, unless the task asks for it with `"from": "caller"` in its `setgid`. A task that keeps your user keeps your groups.
+
+## The environment of the command
+
+The command does not inherit your environment. Only the variables allowed by the `env` option of the task cross the privilege boundary, and the variables that PAM modules set (`pam_env`, `pam_systemd`) go through the same filter. This is what stopped the `APT_CONFIG` hook of the WebOps scenario.
+
+`dosr` then sets a few variables itself:
+
+- `USER`, `LOGNAME`, `HOME` and `SHELL`, of the user the command runs as;
+- `PATH`, from the `path` option of the task;
+- `RAR_USER`, `RAR_UID`, `RAR_GID` and `RAR_COMMAND`, who asked for what;
+- `SUDO_USER`, `SUDO_UID`, `SUDO_GID` and `SUDO_COMMAND`, the same values, for the scripts written for sudo;
+- `TERM`, set to `unknown` if you had none.
+
+With `-E`, you ask to keep your own variables. It is only accepted by a task that allows it, and even then, the `delete` and `check` lists still apply. See [Preserving the environment with `dosr -E`](../configuration.md#preserving-the-environment-with-dosr--e).
+
+## The working directory: `-D`
+
+The command runs in your current directory, entered as the user of the command, or in the directory that the `workdir` option forces. With `-D`, you ask for another directory, among those that the `workdir` option allows.
+
+## Authentication
+
+`dosr` authenticates you through PAM, with the `dosr` service: `/etc/pam.d/dosr`. A task may skip it with the `authentication` option, but think twice: this is the only step that proves the person typing is really the owner of the account.
+
+A wrong password is asked again, after "Sorry, try again.", up to 3 times by default, with a delay of 5 seconds after each failure. The delay makes guessing slow. Any other PAM error stops at once. The `password` option changes both values, at any level of the policy:
+
+```bash
+chsr options password set --tries 3 --delay 00:00:05
+```
+
+`-p` changes the prompt, and `-S` reads the password from the standard input, when there is no terminal. When two `dosr` of the same pipeline need a password, like in `dosr cat a | dosr tee b`, the second one waits until the first is authenticated, and then reuses its cookie when the timeout allows it. They do not fight for your keystrokes anymore.
+
+### Timestamps
+
+Typing your password for every command is tiring, so `dosr` remembers a successful authentication for a while, according to the `timeout` option:
+
+- `type` is the scope of the cookie. `ppid` reuses it for the same parent process (your shell) in the same session, `tty` for the same terminal, and `uid` for any process of your user, which is the widest;
+- `duration` is how long it stays valid;
+- `max_usage` is how many commands it can serve.
+
+For their `sys-admin` role, the WebOps team chose a cookie per terminal, valid for one minute and one command only: this role is root-equivalent, so its authentication must stay fresh.
+
+`dosr -K` removes your cookies, so the next command asks for your password again. Without a command, it only removes them.
+
+
+If you are using cookies for uid, be warned about this feature. If anyone has access to your user account, they can then use your cookie, performing privileged operations without needing your password. This all matters of your own security policy.
+
+
+## While the command runs
+
+When you run `dosr` from a terminal, the command gets its own pseudo-terminal: it cannot push characters into your terminal to make your shell run them. `dosr` forwards the signals it receives to the command.
+
+- **Ctrl+Z** suspends the command like any shell job, and `fg` or `bg` resumes it. Your unsaved work in an editor is not lost.
+- **When `dosr` has to stop the command itself**, it sends SIGHUP and SIGTERM first, then SIGKILL two seconds later. A package manager or a database has time to remove its lock or to finish a write.
+- **The exit status** is the one of the command. If the command was killed by a signal, `dosr` ends with the same signal, so your shell sees the usual 128 + N: 130 for Ctrl+C, 143 for SIGTERM. The errors of `dosr` itself end with status 1.
+
+## Logs
+
+Every execution, every refusal and every authentication failure is written to syslog, with the `auth` facility. An execution looks like this:
+
+```text
+bob : TTY=/dev/pts/0 ; PWD=/home/bob ; ROLE=caddy-audit ; TASK=read-logs ; USER=bob ; GROUPS=adm,systemd-journal ; CAPS=none ; COMMAND=/usr/bin/tail -n 50 /var/log/caddy/access.log
+```
+
+With systemd, you can read them with:
+
+```bash
+journalctl -t dosr
+```
+
+## Checking your rights: `-i`
+
+`-i` shows what `dosr` would do, without running the command:
+
+```text
+$ dosr -i tail -n 50 /var/log/caddy/access.log
+Role: caddy-audit
+Task: read-logs
+Execute as user: Your current user and group(s): adm (4), systemd-journal (999)
+With capabilities: None
+Command: /usr/bin/tail ["-n", "50", "/var/log/caddy/access.log"]
+```
+
+It only works with tasks whose `execinfo` option is `show`. Listing what the policy allows is valuable information for an attacker, so the WebOps team hides it everywhere: for them, `dosr -i` always answers that it is not allowed. An administrator can still read the whole policy with `chsr`.
+
+## Coming from sudo
+
+We kept most of the sudo command line, so that your habits and your scripts keep working. However, a few options differ:
+
+| sudo | dosr | Note |
+|------|------|------|
+| `-u`, `-g`, `-E`, `-D`, `-p`, `-S`, `-K` | same | Only within what the task allows. |
+| `-r` (SELinux role) | `-r` | The RootAsRole role. |
+| `-i` (login shell) | `-i` | Prints the execution context instead. |
+| `-l` | `-i` | For one command, if `execinfo` is `show`. |
+| `-k` | `-K` | Removes the cookies. |
+| `-s`, `-b`, `-n`, `-A`, `sudoedit` | none | Not available. |
+
+If you're accustomed to utilizing the sudo tool and find it difficult to break that habit, consider creating an alias:
+
```sh
alias sudo="dosr"
alias sr="dosr"
@@ -34,13 +181,18 @@ alias sr="dosr"
### Future Design Considerations
-Today, we copied completely the CLI of sudo, thus ensuring old scripts compatibility.
+Today, the CLI of `dosr` follows the one of sudo, to keep old scripts working. We might follow a new design in the future, with retro-compatibility enabled. For example, we could detect when the command name is `sudo` and then use the sudo CLI design, otherwise fall back to the new design.
-We might following a new design in the future but with retro-compatibility enabled. For example, we could detect when the command name is sudo then using the sudo CLI design, otherwise fallback to a new design.
+## When something goes wrong
-## Examples
+`You are not allowed to execute this command, this incident will be reported.` --> No task of your roles matches this command, with these options.
-```bash
-dosr reboot
-dosr -r ops -t reboot reboot
-```
\ No newline at end of file
+`Permission denied` --> Two equivalent tasks match: the policy must be fixed. The log has the details.
+
+`dosr: the task needs capabilities that this session cannot obtain anymore: …` --> The task needs capabilities that are out of the bounding set of your session, for example in a container.
+
+`This incident is reported.` --> The authentication failed.
+
+`You need at least dac_read_search or dac_override, setpcap and setuid capabilities to run dosr` --> `dosr` itself lacks its file capabilities: check the installation.
+
+In every case, the log says more than the terminal, on purpose.
diff --git a/book/src/configuration.md b/book/src/configuration.md
index 0c2136a3..fe3c24a8 100644
--- a/book/src/configuration.md
+++ b/book/src/configuration.md
@@ -88,7 +88,7 @@ The data is split into two parts: the **root file**, which tells RaR where the p
```json
{
- "version": "4.1.0",
+ "version": "4.2.0",
"storage": {
"method": "json",
"settings": {
@@ -109,7 +109,7 @@ For the WebOps team, the policy will be stored in `/etc/security/rootasrole.d/de
```json
{
- "version": "4.1.0",
+ "version": "4.2.0",
"options": { },
"roles": [ ]
}
@@ -230,11 +230,21 @@ Arguments can be matched in two ways:
/usr/bin/install ^-d -m 0?[0-7]{3} /srv/www/[^ ]+$
```
-Regular expressions follow the syntax of the Rust [`regex`](https://docs.rs/regex/latest/regex/#syntax) crate. Note that this syntax does not support look-around nor backreferences.
+Regular expressions follow the syntax of the Rust [`regex`](https://docs.rs/regex/latest/regex/#syntax) crate. Note that this syntax does not support look-around nor backreferences. For a safer implementation of regex, we encapsulated the regex inside a non-capturing group, so the regex looks like `^(?:your_regex_here)$`.
-
-We are still working on the way to express a regular expression safely on the arguments.
-
+Note that when arguments hold special characters, the regex must take into account the quotes needed by the shell to express them. Before matching, `dosr` joins the arguments the way a shell would quote them, with single quotes only:
+
+- an argument that contains a space, a tab, a newline, or one of `'`, `"`, `\`, `|`, `&`, `;`, `<`, `>`, `(`, `)`, `$`, `` ` ``, `*`, `?`, `[`, `#`, `~`, `=` or `%` is wrapped in single quotes;
+- an empty argument becomes `''`;
+- a single quote inside an argument is written `'\''`.
+
+So `ls -l "My Documents"` is matched by `/usr/bin/ls ^-l 'My Documents'$`, and never by `^-l "My Documents"$`. The `=` of an option is the most common trap: bob's `journalctl --unit=caddy --no-pager` is seen as `'--unit=caddy' --no-pager`, so the regex must be `^'--unit=caddy' --no-pager$`. For `ls -l "My Doc'uments"`, the backslash of `'\''` must be escaped in the regex, `^-l 'My Doc'\\''uments'$`, and once more in the JSON file (`\\\\`).
+
+Exact matches are not concerned: the arguments written in the policy are quoted the same way before the comparison.
+
+For example, the following command `ls -l "My Doc'uments"`, must be translated in the policy in a single quote form: `/usr/bin/ls ^-l 'My Doc'\\\\''uments'$`. This amount of escaping is needed because the policy is a JSON file, and the regex is a string inside it. The shell will remove the quotes and the backslashes, and the regex engine will see `My Doc'uments` as expected.
+
+An argument is enclosed in single quotes whenever it contains any of the following characters: space, tab, newline, ‘ " \ | & ; < > ( ) $ ` * ? [ # ~ = %. An empty argument becomes ''. Non-regex arguments does not have this escaping requirement.
### Applying it to WebOps
@@ -277,10 +287,18 @@ The `setuid` field sets the user the command runs as. In security terms, this is
Most administrators want to be a single user: root, because the system's discretionary access control (DAC) is built around it. RaR suggests another approach: when impersonating root is needed, grant it **without capabilities**. Root then only has the rights given by file permissions, like a regular user. Going further, system configuration that administrators need should have a segregated DAC, owned by a dedicated user, so that bypassing it requires an explicit Linux capability.
+One note is : If you don't specify a `setgid`, the command is taking groups from the `setuid` user, aligning with DAC policy. If you want to reduce/edit the groups, you must specify a `setgid` to override the default.
+
+Also, if the user or group in the task does not exist, the task is left out, like a task that does not match: another task may still be chosen. The missing user or group is written in the log.
+
### `setgid`
The `setgid` field makes DAC configuration easier. You can define a single group, or a list of groups. If a list is defined, the first group is the primary group, and the others are supplementary groups.
+Now, let's discuss about subtleties. the `setgid` field can start from the caller groups, or from the `setuid` (target) user groups, with the `from` field of its [selector form](#setgid-1). If you don't specify a `setgid`, the command is taking groups from the target user, aligning with DAC policy. If you want to reduce/edit the groups, you must specify a `setgid` to override the default.
+
+Same as `setuid`, if a group of the task does not exist, the task is left out, like a task that does not match. The missing group is written in the log.
+
### `capabilities`
Linux divides the privileges of the superuser into distinct units called capabilities. Unlike DAC permissions tied to files, capabilities are assigned to processes. They allow granting a specific privilege to a task without running it as root.
@@ -377,6 +395,22 @@ Gives no capability, except `CAP_NET_BIND_SERVICE`. This is a common use case fo
}
```
+`fallback` is the group set used when the caller does not specify `-g`. Without `fallback`, the `from` field says whose groups the command gets:
+
+```json
+"setgid": {
+ "default": "none",
+ "from": "caller"
+}
+```
+
+- `target` (the default): the groups of the user the command runs as, its primary group and the groups that list it as a member, as a login gives them;
+- `caller`: the groups of the user who runs `dosr`.
+
+Without `fallback` nor `from`, the `none` default requires `-g`, and the `all` default gives the groups of the target user. With chsr, `--setgid-from` sets it, for example `chsr role admin task backup credentials set --setuid backup --setgid-from caller`.
+
+Keep `caller` for the tasks that really need it: the command then runs as the target user with every group of the caller (`adm`, `docker`…), which neither of them has alone.
+
`setuid` and `setgid` can also be written in their compact mandatory form (a single user, or a group/group list), as in the WebOps tasks.
## Options and inheritance
@@ -474,6 +508,10 @@ For bob's `read-logs` task, the `set` directive disables the shell escape of `le
Since no `default` is declared at the task level, the global mode and lists are inherited, and these values are added on top.
+#### PAM management of environment variables
+
+In the case where PAM is used to set environment variables through `pam_env` or `pam_env.so`. The `env` option of RaR will still filter these variables according to the policy, ensuring that only allowed variables are passed to the command.
+
### The `path` option
The `PATH` variable is a colon-separated list of directories searched for executables. The `path` option controls it and must be carefully configured to avoid privilege escalation.
@@ -484,9 +522,11 @@ This option works, again, like mathematical sets, with `add` and `sub` (alias `d
- `delete`: start from an empty list and add directories. This is the recommended mode.
- `keep-safe`: start from the caller's `PATH`, and remove relative paths (such as `.` or `bin`). Absolute directories are kept as is, even if they are writable by the caller.
-- `keep-unsafe`: start from the caller's `PATH` as is. Avoid it.
+- `keep-unsafe`: start from the caller's `PATH` as is. Avoid it. We use it only for development purposes.
- `inherit`: use the mode of the level above.
+Some details: in `delete` mode, the caller's `PATH` is not used at all. A relative directory is the working directory of the command, which the caller chooses, so except for `keep-unsafe`, relative directories are removed, from the caller's `PATH` as from the `add` lists of the policy (the ones of the policy are written in the log). The directories of the policy come first, then the ones of the caller; the `sub` list is removed, and each directory appears once. Whether a directory exists is not checked. If the resulting list is empty, then the PATH variable is not set at all, meaning that the user must type the full path of the command to run it.
+
For WebOps, the global level only allows system directories, including `/usr/local/bin` where `caddy-probe` lives:
```json
@@ -503,17 +543,21 @@ These directories must only be writable by root; otherwise, anyone able to write
| Option | Values | Description |
|------------------|---------------------------------|-------------------------------------------------------------------------------------------------------------------|
| `authentication` | `perform` \| `skip` | Whether the user must authenticate before running the command. |
-| `timeout` | `type`, `duration`, `max_usage` | How long, and how many times, an authentication remains valid, and its scope (`ppid`, `tty` or `uid`). |
+| `timeout` | `type`, `duration` (hh:mm:ss format), `max_usage` | How long, and how many times, an authentication remains valid, and its scope (`ppid`, `tty` or `uid`). |
| `root` | `privileged` \| `user` | `user` sets the `SECBIT_*` securebits that disable the special privileges of uid 0: root becomes a regular user, and gets only the capabilities granted by the task. `privileged` keeps the legacy root behavior. |
| `bounding` | `strict` \| `ignore` | `strict` enforces the granted capabilities on the bounding set: the command and its children can never regain any other capability. |
| `execinfo` | `show` \| `hide` | Whether `dosr --info` may disclose the existence of the matching policy element to the user. |
| `workdir` | path \| selector | Working directory of the command, or the set of directories the user may choose. |
| `umask` | string | File creation mask of the command. |
+| `password` | `tries`, `delay` (hh:mm:ss format) | Number of attempts and delay between them for password authentication. |
+| `tty` | `owner`: `caller` \| `target` | Who owns the terminal of a command run as another user, when `dosr` runs from a terminal: the caller (the default) or the target user. Generally, the `caller` option is safer, but sudo uses the `target` option behavior. The security of this option depends on the context of use. |
The `root` option deserves attention. On Linux, a process running as uid 0 that executes a binary automatically obtains all capabilities. Without `"root": "user"`, a task with `"setuid": "root"` and `"capabilities": []` would get them back as soon as the command runs another program. This is what makes the WebOps `caddy-service` and `reboot` tasks really unprivileged, so the team sets `root` to `user` and `bounding` to `strict` globally.
`execinfo` also has a security impact: listing what the policy allows is valuable information for an attacker who stole an account. The team sets it to `hide` globally.
+`tty` is written `"tty": { "owner": "target" }`. With `caller`, the user the command runs as cannot reopen its terminal by its name: a program that does, like pinentry through `GPG_TTY`, fails. With `target`, the other processes of that user can open the terminal while the command runs, and read what is typed into it. The default comes from the build (`RAR_TTY_OWNER`, see [Build](install/build.md)).
+
For `sys-admin`, the most critical role, the team requires authentication on every use, with a short and non-reusable timeout:
```json
@@ -535,6 +579,15 @@ This utility addresses differences in pattern syntax and list inheritance:
Tasks still using unmigrated regular expressions are rejected by `dosr` at runtime until the upgrade has been completed.
+### Migrating configurations from version 4.1
+
+No migration is needed from version 4.1 to 4.2.0. However, downgrading from 4.2.0 to 4.1:
+
+* removes the new `password` and `tty` options, and the `from` field of `setgid`;
+* writes a regular expression with a top-level alternation, like `^start|stop$`, as `^(?:start|stop)$`, so that 4.1 does not allow more.
+
+Note that 4.1 gives the caller's groups to a task that changes the user, whatever the policy says.
+
## Hierarchy and separation of duty
Hierarchy and separation of duty (SoD) are designed as plugins on top of the core RBAC-0 model. They are not part of the core model, but they are implemented in the RaR project.
@@ -542,6 +595,10 @@ Hierarchy and separation of duty (SoD) are designed as plugins on top of the cor
- The **hierarchy** plugin lets a role declare its parent roles, through the `parents` field. The role inherits the tasks of its parents.
- The **static separation of duty** plugin declares conflicting roles, through the `ssd` field: a user should never be an actor of two conflicting roles.
+When the lookup of an actor fails, for example a directory service that does not answer, `dosr` cannot know whether the user holds the conflicting role: it then disables every role with an `ssd` field in that policy file, and writes the failure in the log.
+
+Note that A role that is in conflict with one of its parents is invalid, because it would inherit the parent's tasks and thus be in conflict with itself.
+
### Applying it to WebOps
Bob operates Caddy, so he also needs to read its logs. Instead of duplicating the `read-logs` task, `caddy-admin` declares `caddy-audit` as its parent, and inherits its tasks:
@@ -605,7 +662,7 @@ Here is the resulting `/etc/security/rootasrole.d/default.json`:
```json
{
- "version": "4.1.0",
+ "version": "4.2.0",
"options": {
"path": {
"default": "delete",
diff --git a/book/src/install/build.md b/book/src/install/build.md
index c61f773a..2ba6e913 100644
--- a/book/src/install/build.md
+++ b/book/src/install/build.md
@@ -18,13 +18,17 @@ RAR_CHSR_EDITOR_PATH = "/usr/bin/vim"
RAR_TIMEOUT_TYPE = "ppid"
RAR_TIMEOUT_DURATION = "00:05:00"
RAR_TIMEOUT_MAX_USAGE = ""
+RAR_PASSWORD_TRIES = "3"
+RAR_PASSWORD_DELAY = "00:00:05"
+# Who owns the terminal of a command run as another user: caller, or target like sudo.
+RAR_TTY_OWNER = "caller"
RAR_PATH_DEFAULT = "delete"
RAR_PATH_ADD_LIST = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
RAR_PATH_REMOVE_LIST = ""
RAR_ENV_DEFAULT = "delete"
-RAR_ENV_KEEP_LIST = "HOME,USER,LOGNAME,COLORS,DISPLAY,HOSTNAME,KRB5CCNAME,LS_COLORS,PS1,PS2,XAUTHORY,XAUTHORIZATION,XDG_CURRENT_DESKTOP"
-RAR_ENV_CHECK_LIST = "COLORTERM,LANG,LANGUAGE,LC_.*,LINGUAS,TERM,TZ"
-RAR_ENV_DELETE_LIST = "PS4,SHELLOPTS,PERLLIB,PERL5LIB,PERL5OPT,PYTHONINSPECT"
+RAR_ENV_KEEP_LIST = "HOME,USER,LOGNAME,COLORS,DISPLAY,HOSTNAME,KRB5CCNAME,LS_COLORS,PS1,PS2,XAUTHORITY,XAUTHORIZATION,XDG_CURRENT_DESKTOP"
+RAR_ENV_CHECK_LIST = "COLORTERM,LANG,LANGUAGE,LC_*,LINGUAS,TERM,TZ"
+RAR_ENV_DELETE_LIST = "IFS,CDPATH,LOCALDOMAIN,RES_OPTIONS,HOSTALIASES,NLSPATH,PATH_LOCALE,LD_*,_RLD*,TERMINFO,TERMINFO_DIRS,TERMPATH,TERMCAP,ENV,BASH_ENV,PS4,GLOBIGNORE,BASHOPTS,SHELLOPTS,JAVA_TOOL_OPTIONS,PERLIO_DEBUG,PERLLIB,PERL5LIB,PERL5OPT,PERL5DB,FPATH,NULLCMD,READNULLCMD,ZDOTDIR,TMPPREFIX,PYTHONHOME,PYTHONPATH,PYTHONINSPECT,PYTHONUSERBASE,RUBYLIB,RUBYOPT"
RAR_ENV_SET_LIST = ""
RAR_ENV_OVERRIDE_BEHAVIOR = "false"
RAR_AUTHENTICATION = "perform"
@@ -83,6 +87,7 @@ Malformed values strings create compile-time errors.
| `RAR_WORKDIR_ADD_LIST`| Comma-separated (`,`) | Allowed system directories where users are explicitly authorized to execute commands. |
| `RAR_WORKDIR_REMOVE_LIST`| Comma-separated (`,`) | Denylist of forbidden working directories where execution requests are rejected. |
| `RAR_WORKDIR_FALLBACK`| Optional File Path | Forces a static fallback working directory for the executed command if not defined. Warning! This will *always* set the working directory for *every* commands. |
+| `RAR_TTY_OWNER` | String (`"caller"` \| `"target"`) | Determines whether the controlling terminal of the executed command is owned by the calling user or the target user. Note that sudo uses the "target" option by default, but a safer approach is to use "caller", so RaR uses "caller" by default. |
Be very careful with PATH management, "keep-unsafe" is insecure. And I strongly not reccommend it.
Working directory management is somewhat useful for some cases, such as allowing restricted commands only in a specific restricted directory. Of course that means that allowed commands shouldn't change internally the working directory. For example, if you set "/bin/ls" command, and setting fallback workdir to the "/tmp", then all "dosr ls" command will only show "/tmp" content, no matter where the user is located. Otherwise, if you set "/bin/ls .*" for the command, then the user still be able to retrieve folder contents everywhere on the system.
@@ -101,6 +106,8 @@ Be very careful with PATH management, "keep-unsafe" is insecure. And I strongly
| `RAR_TIMEOUT_MAX_USAGE`| Integer (`u64`) | Absolute limits on how many times a given token context can be reused. |
| `RAR_TIMEOUT_STORAGE` | Folder Path | Filesystem path used by the timeout engine to persist execution timestamp tokens. |
| `RAR_EXEC_INFO_DISPLAY`| String (`"hide"` \| `"show"`) | Give the ability to users to know their allowed commands and configuration applied. |
+| `RAR_PASSWORD_TRIES` | Integer (`u8`) | Maximum number of password attempts allowed before aborting the authentication sequence. |
+| `RAR_PASSWORD_DELAY` | Duration `"hh:mm:ss"` | The time to wait between password attempts. |
Showing to a user their policy can help attackers in their enumeration phase. A good policy knows what command a user is allowed to do in a such way that the user don't know that there is a strict policy applied.
diff --git a/book/src/install/installation.md b/book/src/install/installation.md
index 1fecb555..89eb2915 100644
--- a/book/src/install/installation.md
+++ b/book/src/install/installation.md
@@ -32,6 +32,25 @@ This is a complete process for compiling and installing `dosr` and `chsr` binari
- Rust toolchain
- Administrative rights (`sudo` or equivalent)
+## Dependencies installation
+
+Since 4.2.0, we removed the auto dependencies installation through `cargo xtask` because it takes responsibilities that are not the purpose of the project. So we now require you to install dependencies yourself:
+
+| Distribution | Dependencies |
+|---|---|
+| Debian, Ubuntu | `apt install clang pkg-config libpam0g-dev libseccomp-dev pandoc` |
+| Fedora, RHEL family | `dnf install clang pkgconfig pam-devel libseccomp-devel pandoc` |
+| openSUSE | `zypper install clang pkg-config pam-devel libseccomp-devel pandoc` |
+| Arch Linux | `pacman -S clang pkgconf pam libseccomp pandoc-cli` |
+
+Note that `clang` is selected in the case you want to compile the capable tool. If you prefer using `gcc`, feel free to use it instead.
+
+Also, `pandoc` is only required if you want to build the man pages from source.
+
+If you are using another distribution, you can find their names on these websites [pkgs.org](https://pkgs.org/) or [repology.org](https://repology.org/).
+
+If you miss any dependency, you can use the `cargo xtask doctor` command.
+
### Retrieve the source code
```bash
@@ -39,7 +58,7 @@ git clone https://github.com/LeChatP/RootAsRole
cd RootAsRole
```
-## Dependencies installation, compiling and installing
+## Compiling and installing
Before installing the tool, you might want to define some default behaviors. You'll find them in this page [Build-time default configuration](build.md).
@@ -48,12 +67,11 @@ It might be trivial, but in order to install RootAsRole, you needs full administ
To manage that, we developed an installation helper tool
```bash
-cargo xtask install -bip sudo
+cargo xtask install -bp sudo
```
This command performs:
-- dependency installation when required (privileged)
- project build
- deployment of `dosr` and `chsr` in `RAR_BIN_PATH` (privileged)
- capability/ownership setup for `dosr` (privileged)
diff --git a/book/src/security.md b/book/src/security.md
index 8b4b7696..6aae875b 100644
--- a/book/src/security.md
+++ b/book/src/security.md
@@ -14,7 +14,11 @@ In the RaR context, it describes the security mechanisms that secures the progra
- Capability-oriented privilege model
- Optional timestamp/timeout behavior
- Immutable policy file workflow
-- Hardened policy editor path in `chsr editor` (landlock/seccomp)
+- Hardened policy editor path in `chsr editor` (landlock)
+
+
+The hardening of the policy editor is complex to do with a generic editor tool. For now, only landlock is enforced. We need to look at seccomp protection in the editor mode.
+
## Operational safeguards
diff --git a/core/src/database/actor.rs b/core/src/database/actor.rs
index 9c9205ca..65795e5d 100644
--- a/core/src/database/actor.rs
+++ b/core/src/database/actor.rs
@@ -1,6 +1,9 @@
use std::{
borrow::Cow,
+ cell::RefCell,
+ collections::HashMap,
fmt::{self, Display, Formatter, Write},
+ thread::LocalKey,
};
use bon::bon;
@@ -77,17 +80,49 @@ impl SUserType {
}
}
+thread_local! {
+ /// The ids of the names that this thread looked up. A policy names the same users and groups
+ /// in many of its tasks (root above all), and each lookup goes through NSS, which may query
+ /// systemd-userdb or a directory service: about 20 µs, for each task of a policy. A failed
+ /// lookup is not kept, so that it is seen each time.
+ static USER_IDS: RefCell>> = RefCell::new(HashMap::new());
+ static GROUP_IDS: RefCell>> = RefCell::new(HashMap::new());
+}
+
+/// The id of `name` in `cache`, else from `lookup`, kept when the lookup succeeds.
+fn cached_id(
+ cache: &'static LocalKey>>>,
+ name: &str,
+ lookup: impl FnOnce() -> nix::Result>,
+) -> nix::Result> {
+ if let Some(id) = cache.with(|ids| ids.borrow().get(name).copied()) {
+ return Ok(id);
+ }
+ let id = lookup()?;
+ cache.with(|ids| ids.borrow_mut().insert(name.to_string(), id));
+ Ok(id)
+}
+
impl DUserType<'_> {
- #[must_use]
- pub fn fetch_id(&self) -> Option {
+ /// The uid of the actor, a name being looked up once per thread: `Ok(None)` when no user has
+ /// that name, an error when the lookup itself fails (a directory service that does not
+ /// answer...).
+ ///
+ /// # Errors
+ /// The error of `getpwnam_r(3)`.
+ pub fn try_fetch_id(&self) -> nix::Result> {
match &self.0 {
- DGenericActorType::Id(id) => Some(*id),
- DGenericActorType::Name(name) => match User::from_name(name) {
- Ok(Some(user)) => Some(user.uid.as_raw()),
- _ => None,
- },
+ DGenericActorType::Id(id) => Ok(Some(*id)),
+ DGenericActorType::Name(name) => cached_id(&USER_IDS, name, || {
+ Ok(User::from_name(name)?.map(|user| user.uid.as_raw()))
+ }),
}
}
+ /// [`Self::try_fetch_id`], a failed lookup being no user.
+ #[must_use]
+ pub fn fetch_id(&self) -> Option {
+ self.try_fetch_id().ok().flatten()
+ }
#[must_use]
pub fn fetch_user(&self) -> Option {
match &self.0 {
@@ -154,16 +189,26 @@ impl SGroupType {
}
impl DGroupType<'_> {
- #[must_use]
- pub fn fetch_id(&self) -> Option {
+ /// The gid of the actor, a name being looked up once per thread: `Ok(None)` when no group has
+ /// that name, an error when the lookup itself fails (a directory service that does not
+ /// answer, a group whose members take more than the 1 MiB that nix allows for
+ /// `getgrnam_r(3)`...).
+ ///
+ /// # Errors
+ /// The error of `getgrnam_r(3)`.
+ pub fn try_fetch_id(&self) -> nix::Result> {
match &self.0 {
- DGenericActorType::Id(id) => Some(*id),
- DGenericActorType::Name(name) => match Group::from_name(name) {
- Ok(Some(group)) => Some(group.gid.as_raw()),
- _ => None,
- },
+ DGenericActorType::Id(id) => Ok(Some(*id)),
+ DGenericActorType::Name(name) => cached_id(&GROUP_IDS, name, || {
+ Ok(Group::from_name(name)?.map(|group| group.gid.as_raw()))
+ }),
}
}
+ /// [`Self::try_fetch_id`], a failed lookup being no group.
+ #[must_use]
+ pub fn fetch_id(&self) -> Option {
+ self.try_fetch_id().ok().flatten()
+ }
#[must_use]
pub fn fetch_group(&self) -> Option {
match &self.0 {
@@ -1325,4 +1370,28 @@ mod tests {
DActor::Unknown(_)
));
}
+
+ // a name is looked up once per thread, and a name that nobody has is kept too
+ #[test]
+ fn test_name_lookups_are_kept() {
+ let root = DUserType::from("root");
+ assert_eq!(root.try_fetch_id().unwrap(), Some(0));
+ assert_eq!(
+ USER_IDS.with(|ids| ids.borrow().get("root").copied()),
+ Some(Some(0))
+ );
+ assert_eq!(root.try_fetch_id().unwrap(), Some(0));
+ assert_eq!(DUserType::from("rar-no-such-user").fetch_id(), None);
+ assert_eq!(
+ USER_IDS.with(|ids| ids.borrow().get("rar-no-such-user").copied()),
+ Some(None)
+ );
+ assert_eq!(DGroupType::from("root").try_fetch_id().unwrap(), Some(0));
+ assert_eq!(
+ GROUP_IDS.with(|ids| ids.borrow().get("root").copied()),
+ Some(Some(0))
+ );
+ // an id is never looked up
+ assert_eq!(DUserType::from(42).try_fetch_id().unwrap(), Some(42));
+ }
}
diff --git a/core/src/database/command.rs b/core/src/database/command.rs
new file mode 100644
index 00000000..64540af5
--- /dev/null
+++ b/core/src/database/command.rs
@@ -0,0 +1,160 @@
+//! How a command of the policy is written: its path, then its arguments, which may be a
+//! regular expression. dosr matches the commands and chsr writes them, both read them here.
+
+/// The path of a command of the policy and its arguments, both as written.
+///
+/// The path keeps its quotes, and a regular expression must not go through shell splitting,
+/// which removes its backslashes and splits it on its spaces.
+#[must_use]
+pub fn split_command(line: &str) -> Option<(&str, &str)> {
+ let line = line.trim_start();
+ let first = line.chars().next()?;
+ let path_end = if first == '\'' || first == '"' {
+ line[1..].find(first)? + 2
+ } else {
+ line.find(char::is_whitespace).unwrap_or(line.len())
+ };
+ Some((&line[..path_end], &line[path_end..]))
+}
+
+/// The regular expression of the arguments of a command of the policy, as written after its
+/// path: arguments starting with `^` and ending with `$`, single-quoted or not.
+#[must_use]
+pub fn regex_arguments(args: &str) -> Option<&str> {
+ let args = args.trim();
+ let args = args
+ .strip_prefix('\'')
+ .and_then(|quoted| quoted.strip_suffix('\''))
+ .filter(|quoted| quoted.starts_with('^') && quoted.ends_with('$'))
+ .unwrap_or(args);
+ (args.len() >= 2 && args.starts_with('^') && args.ends_with('$')).then_some(args)
+}
+
+/// The body of the regular expression of the arguments, between its `^` and its final `$`. A
+/// final `\$` is a dollar sign, not the end of the arguments, and stays in the body.
+#[must_use]
+pub fn regex_body(regex: &str) -> &str {
+ let body = regex.strip_prefix('^').unwrap_or(regex);
+ match body.strip_suffix('$') {
+ Some(stripped) if !ends_with_an_escape(stripped) => stripped,
+ _ => body,
+ }
+}
+
+/// The regular expression of the arguments, anchored at both ends whatever its alternations.
+///
+/// `^start|stop$` alone is `^start` or `stop$`, which allows any arguments that start with
+/// `start` or end with `stop`.
+#[must_use]
+pub fn anchored_regex(regex: &str) -> String {
+ format!("^(?:{})$", regex_body(regex))
+}
+
+/// Whether `body` has a `|` outside of any group and character class.
+///
+/// It is the alternation that `^…$` does not anchor on both sides.
+#[must_use]
+pub fn has_top_level_alternation(body: &str) -> bool {
+ let (mut groups, mut classes) = (0usize, 0usize);
+ let mut chars = body.chars().peekable();
+ while let Some(c) = chars.next() {
+ match c {
+ '\\' => {
+ chars.next();
+ }
+ '[' => {
+ classes += 1;
+ // a `]` right after `[` or `[^` is a bracket, not the end of the class
+ chars.next_if_eq(&'^');
+ chars.next_if_eq(&']');
+ }
+ ']' if classes > 0 => classes -= 1,
+ '(' if classes == 0 => groups += 1,
+ ')' if classes == 0 => groups = groups.saturating_sub(1),
+ '|' if classes == 0 && groups == 0 => return true,
+ _ => {}
+ }
+ }
+ false
+}
+
+fn ends_with_an_escape(text: &str) -> bool {
+ text.chars().rev().take_while(|&c| c == '\\').count() % 2 == 1
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn test_split_command() {
+ assert_eq!(
+ split_command("/usr/bin/tail ^-n [0-9]+$"),
+ Some(("/usr/bin/tail", " ^-n [0-9]+$"))
+ );
+ assert_eq!(
+ split_command(" '/opt/my tool' -v"),
+ Some(("'/opt/my tool'", " -v"))
+ );
+ assert_eq!(
+ split_command("\"/opt/my tool\""),
+ Some(("\"/opt/my tool\"", ""))
+ );
+ assert_eq!(split_command("/usr/bin/id"), Some(("/usr/bin/id", "")));
+ assert_eq!(split_command(""), None);
+ // an unterminated quote is not a path
+ assert_eq!(split_command("'/usr/bin/id"), None);
+ }
+
+ #[test]
+ fn test_anchored_regex() {
+ assert_eq!(anchored_regex("^start|stop$"), "^(?:start|stop)$");
+ assert_eq!(anchored_regex("^-n [0-9]+$"), "^(?:-n [0-9]+)$");
+ assert_eq!(anchored_regex("^$"), "^(?:)$");
+ // an escaped dollar sign is part of the body
+ assert_eq!(regex_body("^price \\$"), "price \\$");
+ assert_eq!(anchored_regex("^price \\$"), "^(?:price \\$)$");
+ // an escaped backslash before the final $ does not escape it
+ assert_eq!(regex_body("^a\\\\$"), "a\\\\");
+ }
+
+ #[test]
+ fn test_has_top_level_alternation() {
+ for body in [
+ "start|stop",
+ "(?i)start|stop",
+ "a(b|c)|d",
+ "[a-z]|x",
+ "\\(|x",
+ ] {
+ assert!(has_top_level_alternation(body), "{body}");
+ }
+ for body in [
+ "(start|stop)",
+ "(?:start|stop) now",
+ "[|]",
+ "[]|]",
+ "[^]|]",
+ "[[:alpha:]|]+",
+ "a\\|b",
+ "-n [0-9]+",
+ "",
+ ] {
+ assert!(!has_top_level_alternation(body), "{body}");
+ }
+ }
+
+ #[test]
+ fn test_regex_arguments() {
+ assert_eq!(
+ regex_arguments(" ^(-n [0-9]+|-f) /var/log/caddy/[^/ ]+$"),
+ Some("^(-n [0-9]+|-f) /var/log/caddy/[^/ ]+$")
+ );
+ assert_eq!(regex_arguments(" '^-f a\\.log$' "), Some("^-f a\\.log$"));
+ assert_eq!(regex_arguments("^$"), Some("^$"));
+ assert_eq!(regex_arguments(" --no-pager -u caddy"), None);
+ assert_eq!(regex_arguments("^"), None);
+ // what chsr wrote before 4.2.0: every word quoted on its own
+ assert_eq!(regex_arguments(" '^(-n' '[0-9]+|-f)'"), None);
+ }
+}
diff --git a/core/src/database/de.rs b/core/src/database/de.rs
index 960ad3c2..f2336527 100644
--- a/core/src/database/de.rs
+++ b/core/src/database/de.rs
@@ -6,7 +6,7 @@ use serde::{Deserialize, de::DeserializeSeed};
use crate::database::{
actor::SGroups,
- structs::{SCommand, SSetgidSet, SetBehavior},
+ structs::{GroupsFrom, SCommand, SSetgidSet, SetBehavior},
};
use super::{
@@ -294,6 +294,8 @@ impl<'de> Deserialize<'de> for SSetgidSet {
Add,
#[serde(alias = "del", alias = "s")]
Sub,
+ #[serde(alias = "o")]
+ From,
}
impl<'de> Visitor<'de> for SSetgidSetVisitor {
@@ -311,12 +313,16 @@ impl<'de> Deserialize<'de> for SSetgidSet {
let mut add = Vec::new();
let mut sub = Vec::new();
let mut fallback = None;
+ let mut from = None;
while let Some(key) = map.next_key::()? {
match key {
Field::Default => {
default_behavior = map.next_value()?;
}
+ Field::From => {
+ from = Some(map.next_value::()?);
+ }
Field::Fallback => {
fallback.replace(map.next_value::()?);
}
@@ -335,6 +341,7 @@ impl<'de> Deserialize<'de> for SSetgidSet {
fallback,
add,
sub,
+ from,
})
}
}
@@ -639,6 +646,41 @@ mod tests {
}
}
+ #[test]
+ fn test_s_setgid_set_from() {
+ // alone, from says whose groups the command gets
+ let set: SSetgidSet = serde_json::from_value(json!({"from": "caller"})).unwrap();
+ assert_eq!(set.default_behavior, SetBehavior::None);
+ assert_eq!(set.from, Some(GroupsFrom::Caller));
+ assert_eq!(
+ serde_json::to_value(&set).unwrap(),
+ json!({"default": "none", "from": "caller"})
+ );
+ for json_data in [
+ json!({"from": "target"}),
+ json!({"default": "none", "add": [["adm"]], "from": "caller"}),
+ // a fallback with from is not written as a mandatory group
+ json!({"default": "none", "fallback": ["adm"], "from": "caller"}),
+ ] {
+ let set: SSetgidSet = serde_json::from_value(json_data.clone()).unwrap();
+ assert!(set.from.is_some(), "{json_data}");
+ let again: SSetgidSet =
+ serde_json::from_value(serde_json::to_value(&set).unwrap()).unwrap();
+ assert_eq!(again, set, "{json_data}");
+ let cbor = cbor4ii::serde::to_vec(Vec::new(), &set).unwrap();
+ let again: SSetgidSet = cbor4ii::serde::from_slice(&cbor).unwrap();
+ assert_eq!(again, set, "{json_data}");
+ }
+ // without from, nothing is written
+ let set: SSetgidSet = serde_json::from_value(json!({"default": "all"})).unwrap();
+ assert_eq!(set.from, None);
+ assert_eq!(
+ serde_json::to_value(&set).unwrap(),
+ json!({"default": "all"})
+ );
+ assert!(serde_json::from_value::(json!({"from": "someone"})).is_err());
+ }
+
#[test]
fn test_invalid_selector_entries_are_errors() {
// the policy comes from a file: a mistake is an error, never a panic
diff --git a/core/src/database/env.rs b/core/src/database/env.rs
index 22ca8eea..879d8065 100644
--- a/core/src/database/env.rs
+++ b/core/src/database/env.rs
@@ -1,10 +1,15 @@
//! How the environment of a command is decided, for dosr and chsr alike.
//!
//! The env options of the default, global, role and task levels are merged into one set of
-//! lists ([`ResolvedEnv`]), then the variables of the user are filtered with them.
+//! lists ([`ResolvedEnv`]), then the variables of the user are filtered with them. The same
+//! filter ([`EnvFilter`]) applies to the variables that PAM modules set, such as `pam_env`.
//! See [`SEnvOptions`](super::options::SEnvOptions) for the meaning of each list.
-use std::collections::HashMap;
+use std::{
+ borrow::Borrow,
+ collections::{HashMap, hash_map::Entry},
+ hash::Hash,
+};
use indexmap::{IndexMap, IndexSet};
use libc::PATH_MAX;
@@ -112,22 +117,25 @@ impl<'a> ResolvedEnv<'a> {
/// - in both modes, a variable of the check list is passed only if its value is safe.
#[must_use]
pub fn keep_user_var(&self, key: &str, value: &str) -> bool {
- if is_shell_function(value) {
- return false;
- }
- let checked = env_matches(&self.check, key);
- match self.behavior {
- EnvBehavior::Delete => {
- if checked {
- check_env(key, value)
- } else {
- env_matches(&self.keep, key)
- }
- }
- EnvBehavior::Keep => {
- !env_matches(&self.delete, key) && (!checked || check_env(key, value))
- }
- EnvBehavior::Inherit => false,
+ keeps_var(
+ self.behavior,
+ &self.keep,
+ &self.check,
+ &self.delete,
+ key,
+ value,
+ )
+ }
+
+ /// The same filter as [`ResolvedEnv::keep_user_var`], owned: it outlives the policy.
+ #[must_use]
+ pub fn filter(&self) -> EnvFilter {
+ let owned = |list: &IndexSet<&str>| list.iter().map(|entry| (*entry).to_string()).collect();
+ EnvFilter {
+ behavior: self.behavior,
+ keep: owned(&self.keep),
+ check: owned(&self.check),
+ delete: owned(&self.delete),
}
}
@@ -154,13 +162,19 @@ impl<'a> ResolvedEnv<'a> {
})
.collect::>();
let path: Vec<_> = path.into_iter().collect();
- final_env.insert(
- "PATH".into(),
- path.iter()
- .map(AsRef::as_ref)
- .collect::>()
- .join(":"),
- );
+ if path.is_empty() {
+ // An empty PATH is the working directory for shells and execvp(3): without any
+ // directory, the command has no PATH, and its own default applies.
+ final_env.remove("PATH");
+ } else {
+ final_env.insert(
+ "PATH".into(),
+ path.iter()
+ .map(AsRef::as_ref)
+ .collect::>()
+ .join(":"),
+ );
+ }
let target_user = target.unwrap_or(¤t_user.user);
final_env.insert("LOGNAME".into(), target_user.name.clone());
final_env.insert("USER".into(), target_user.name.clone());
@@ -189,6 +203,89 @@ impl<'a> ResolvedEnv<'a> {
}
}
+/// The filter of the policy on the variables passed to the command, once the policy is gone.
+///
+/// dosr decides the environment of the command before the PAM session is open; the variables
+/// that PAM modules set then (`pam_env`, `pam_systemd`, `pam_getenvlist(3)`) go through this
+/// filter, like the variables of the user: they may come from files that the user writes, such
+/// as `~/.pam_environment` with `pam_env user_readenv=1`. The default filter keeps nothing.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct EnvFilter {
+ behavior: EnvBehavior,
+ keep: IndexSet,
+ check: IndexSet,
+ delete: IndexSet,
+}
+
+impl EnvFilter {
+ /// Whether a variable is passed to the command, see [`ResolvedEnv::keep_user_var`].
+ #[must_use]
+ pub fn keeps(&self, key: &str, value: &str) -> bool {
+ keeps_var(
+ self.behavior,
+ &self.keep,
+ &self.check,
+ &self.delete,
+ key,
+ value,
+ )
+ }
+
+ /// Add to the environment of the command the variables that the filter keeps, unless the
+ /// environment already has them: the kept variables of the user, the variables set by dosr
+ /// and the `set` list of the policy take precedence. `PATH` is never added: the path options
+ /// decide it, and leave it out when no directory remains.
+ pub fn add_vars(
+ &self,
+ env: &mut HashMap,
+ vars: impl IntoIterator- ,
+ ) {
+ for (key, value) in vars {
+ // the path options decide the PATH, which may be absent on purpose
+ if key == "PATH" {
+ debug!("PATH is decided by the path options, the one of PAM is left out");
+ continue;
+ }
+ match env.entry(key) {
+ Entry::Occupied(var) => {
+ debug!("{} is already set, its other value is left out", var.key());
+ }
+ Entry::Vacant(var) if self.keeps(var.key(), &value) => {
+ var.insert(value);
+ }
+ Entry::Vacant(var) => debug!("{} is left out by the policy", var.key()),
+ }
+ }
+ }
+}
+
+/// The rule of [`ResolvedEnv::keep_user_var`] and [`EnvFilter::keeps`], whether the lists are
+/// borrowed from the policy or owned.
+fn keeps_var + Hash + Eq>(
+ behavior: EnvBehavior,
+ keep: &IndexSet
,
+ check: &IndexSet,
+ delete: &IndexSet,
+ key: &str,
+ value: &str,
+) -> bool {
+ if is_shell_function(value) {
+ return false;
+ }
+ let checked = env_matches(check, key);
+ match behavior {
+ EnvBehavior::Delete => {
+ if checked {
+ check_env(key, value)
+ } else {
+ env_matches(keep, key)
+ }
+ }
+ EnvBehavior::Keep => !env_matches(delete, key) && (!checked || check_env(key, value)),
+ EnvBehavior::Inherit => false,
+ }
+}
+
/// Whether the value of a variable of the check list is safe: no `/` nor `%`, except for `TZ`
/// which must be a relative time zone name.
#[must_use]
@@ -201,8 +298,11 @@ pub fn check_env(key: &str, value: &str) -> bool {
}
/// The policy entries are the patterns, never the user's variable name.
-fn env_matches(list: &IndexSet<&str>, name: &str) -> bool {
- list.contains(name) || list.iter().any(|pattern| wildcard_match(pattern, name))
+fn env_matches + Hash + Eq>(list: &IndexSet, name: &str) -> bool {
+ list.contains(name)
+ || list
+ .iter()
+ .any(|pattern| wildcard_match(pattern.borrow(), name))
}
fn tz_is_safe(tzval: &str) -> bool {
@@ -530,4 +630,95 @@ mod tests {
.is_none()
);
}
+
+ #[test]
+ fn test_env_filter_is_the_policy_filter() {
+ let vars = [
+ ("LC_ALL", "C"),
+ ("KEPT", "value"),
+ ("LD_PRELOAD", "/tmp/evil.so"),
+ ("CHECKED", "/unsafe"),
+ ("CHECKED", "safe"),
+ ("TZ", "../../etc/x"),
+ ("TZ", "Europe/Paris"),
+ ("BASH_FUNC_ls%%", "() { evil; }"),
+ ("OTHER", "value"),
+ ];
+ for behavior in [EnvBehavior::Delete, EnvBehavior::Keep, EnvBehavior::Inherit] {
+ let env = resolved(behavior, &["LC_*", "KEPT"], &["CHECKED", "TZ"], &["LD_*"]);
+ let filter = env.filter();
+ for (key, value) in vars {
+ assert_eq!(
+ filter.keeps(key, value),
+ env.keep_user_var(key, value),
+ "{behavior:?} {key}={value}"
+ );
+ }
+ }
+ // a filter that no policy decided keeps nothing
+ assert!(!EnvFilter::default().keeps("LC_ALL", "C"));
+ }
+
+ #[test]
+ fn test_env_filter_add_vars() {
+ let target = cred();
+ let mut env = resolved(EnvBehavior::Delete, &["KEPT", "PAM_*"], &["CHECKED"], &[]);
+ env.set = IndexMap::from([("SET", "policy")]);
+ let mut final_env = env
+ .final_env(
+ [("KEPT", "user")],
+ ["/usr/bin"],
+ &target,
+ None,
+ String::new(),
+ )
+ .unwrap();
+ let pam_vars = [
+ ("PATH", "/tmp/evil"),
+ ("HOME", "/tmp"),
+ ("SET", "pam"),
+ ("KEPT", "pam"),
+ ("PAM_NEW", "pam"),
+ ("CHECKED", "/unsafe"),
+ ("LD_PRELOAD", "/tmp/evil.so"),
+ ("PAM_FUNC", "() { evil; }"),
+ ]
+ .map(|(key, value)| (key.to_string(), value.to_string()));
+ env.filter().add_vars(&mut final_env, pam_vars);
+ // the variables of dosr, of the set list and the kept ones of the user take precedence
+ assert_eq!(final_env.get("PATH").unwrap(), "/usr/bin");
+ assert_eq!(
+ *final_env.get("HOME").unwrap(),
+ target.user.dir.to_string_lossy()
+ );
+ assert_eq!(final_env.get("SET").unwrap(), "policy");
+ assert_eq!(final_env.get("KEPT").unwrap(), "user");
+ // a new variable goes through the filter of the policy
+ assert_eq!(final_env.get("PAM_NEW").unwrap(), "pam");
+ assert!(!final_env.contains_key("CHECKED"));
+ assert!(!final_env.contains_key("LD_PRELOAD"));
+ assert!(!final_env.contains_key("PAM_FUNC"));
+ }
+
+ #[test]
+ fn test_final_env_without_any_directory_has_no_path() {
+ let target = cred();
+ // even a PATH of the user that the policy keeps by name, or one set by PAM
+ let env = resolved(EnvBehavior::Delete, &["PATH"], &[], &[]);
+ let no_dir: [&str; 0] = [];
+ let mut final_env = env
+ .final_env([("PATH", ".:/tmp")], no_dir, &target, None, String::new())
+ .unwrap();
+ assert!(!final_env.contains_key("PATH"));
+ env.filter()
+ .add_vars(&mut final_env, [("PATH".into(), ".".into())]);
+ assert!(!final_env.contains_key("PATH"));
+ // the set list of the policy can still give one
+ let mut env = env;
+ env.set = IndexMap::from([("PATH", "/usr/bin")]);
+ let final_env = env
+ .final_env([("PATH", ".:/tmp")], no_dir, &target, None, String::new())
+ .unwrap();
+ assert_eq!(final_env.get("PATH").unwrap(), "/usr/bin");
+ }
}
diff --git a/core/src/database/migrations.rs b/core/src/database/migrations.rs
index 15211d1d..4d3b8c79 100644
--- a/core/src/database/migrations.rs
+++ b/core/src/database/migrations.rs
@@ -11,7 +11,12 @@ use serde_json::Value;
use crate::{
PACKAGE_VERSION,
- database::migration::{Migration, MigrationError},
+ database::{
+ command::{
+ anchored_regex, has_top_level_alternation, regex_arguments, regex_body, split_command,
+ },
+ migration::{Migration, MigrationError},
+ },
util::{ENV_DELETE_LIST_SLICE, is_valid_env_pattern},
};
@@ -69,6 +74,17 @@ pub const DOCUMENT_MIGRATIONS: &[Migration] = &[
Ok(())
},
},
+ Migration {
+ from: || Version::new(4, 1, 0),
+ to: || Version::new(4, 2, 0),
+ up: unchanged,
+ down: |_, document| {
+ remove_options_of_4_2(document);
+ remove_groups_from(document);
+ rewrite_commands(document, group_top_level_alternation);
+ Ok(())
+ },
+ },
];
/// `LC_.*` -> `LC_*`: the simple regexes used before 4.1.0 become wildcards.
@@ -165,6 +181,84 @@ fn rewrite_path_behaviors(document: &mut Value, rewrite: fn(&str) -> Option<&'st
}
}
+/// 4.1.0 has neither the `password` nor the `tty` option: they are removed from the options of
+/// every level. Without `tty`, 4.1.0 leaves the terminal to the caller, as `"owner": "caller"`.
+fn remove_options_of_4_2(document: &mut Value) {
+ match document {
+ Value::Object(map) => {
+ if let Some(Value::Object(options)) = map.get_mut("options") {
+ for name in ["password", "tty"] {
+ if options.remove(name).is_some() {
+ info!("Removing the {name} option, unknown before 4.2.0");
+ }
+ }
+ }
+ map.values_mut().for_each(remove_options_of_4_2);
+ }
+ Value::Array(values) => values.iter_mut().for_each(remove_options_of_4_2),
+ _ => {}
+ }
+}
+
+/// `from` of a `setgid` selector is unknown before 4.2.0, whatever its key (the CBOR format writes
+/// `o`). A selector with nothing else than `"default": "none"` is removed with it: 4.1.0 then
+/// keeps the groups of the caller, as `from: caller` did, instead of requiring `-g`. 4.1.0 cannot
+/// give the groups of the target user, which `from: target` and a task without `setgid` do.
+fn remove_groups_from(document: &mut Value) {
+ let Value::Object(document) = document else {
+ return;
+ };
+ for roles in ["roles", "r"] {
+ let Some(Value::Array(roles)) = document.get_mut(roles) else {
+ continue;
+ };
+ for role in roles {
+ for tasks in ["tasks", "t"] {
+ let Some(Value::Array(tasks)) = role.get_mut(tasks) else {
+ continue;
+ };
+ for task in tasks {
+ for cred in ["cred", "credentials", "i"] {
+ if let Some(Value::Object(cred)) = task.get_mut(cred) {
+ remove_cred_groups_from(cred);
+ }
+ }
+ }
+ }
+ }
+ }
+}
+
+fn remove_cred_groups_from(cred: &mut serde_json::Map) {
+ for setgid in ["setgid", "g"] {
+ let Some(Value::Object(selector)) = cred.get_mut(setgid) else {
+ continue;
+ };
+ let Some(from) = selector.remove("from").or_else(|| selector.remove("o")) else {
+ continue;
+ };
+ info!("Removing from: {from} of a setgid selector, unknown before 4.2.0");
+ let nothing_else = selector.iter().all(|(key, value)| {
+ matches!(key.as_str(), "default" | "d") && (value == "none" || value == 0)
+ });
+ if nothing_else {
+ cred.remove(setgid);
+ }
+ }
+}
+
+/// A top-level alternation grouped for 4.1.0, which allows no more than 4.2.0.
+///
+/// Since 4.2.0, a regular expression on the arguments matches the whole arguments whatever its
+/// alternations, where 4.1.0 read `^start|stop$` as `^start` or `stop$`. The upgrade leaves it as
+/// written, since it now allows less; the downgrade writes `^(?:start|stop)$`.
+fn group_top_level_alternation(command: &str) -> Option {
+ let (path, args) = split_command(command)?;
+ let regex = regex_arguments(args)?;
+ has_top_level_alternation(regex_body(regex))
+ .then(|| format!("{path} {}", anchored_regex(regex)))
+}
+
/// Whether a command of the policy is only a path, without arguments.
fn path_only(command: &str) -> bool {
let command = command.trim();
@@ -537,7 +631,7 @@ mod tests {
fn test_commands_without_arguments_up_and_down() {
// the upgrade leaves them as written: since 4.1.0 they allow no argument
let commands = json!(["/usr/bin/id", "**", "/usr/bin/ls ^.*$"]);
- let mut document = json!({"roles": [{"tasks": [{"commands": commands.clone()}]}]});
+ let mut document = json!({"roles": [{"tasks": [{"commands": commands}]}]});
Migration::migrate_from(
&Version::new(4, 0, 3),
&PACKAGE_VERSION,
@@ -587,6 +681,225 @@ mod tests {
assert_eq!(document["r"][0]["t"][0]["c"], json!(["/usr/bin/id ^$"]));
}
+ #[test]
+ fn test_password_option_up_and_down() {
+ let mut document = json!({
+ "options": {"password": {"tries": 5}, "timeout": {"type": "tty"}},
+ "roles": [{
+ "name": "r",
+ "options": {"password": {"delay": "00:00:01"}},
+ "tasks": [{"name": "t", "options": {"password": {"tries": 1}}}]
+ }]
+ });
+ let before = document.clone();
+ Migration::migrate_from(
+ &Version::new(4, 1, 0),
+ &PACKAGE_VERSION,
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(document, before, "the upgrade keeps the option");
+
+ Migration::migrate_from(
+ &PACKAGE_VERSION,
+ &Version::new(4, 1, 0),
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(document["options"], json!({"timeout": {"type": "tty"}}));
+ assert_eq!(document["roles"][0]["options"], json!({}));
+ assert_eq!(document["roles"][0]["tasks"][0]["options"], json!({}));
+ }
+
+ #[test]
+ fn test_tty_option_up_and_down() {
+ let mut document = json!({
+ "options": {"tty": {"owner": "target"}, "timeout": {"type": "tty"}},
+ "roles": [{
+ "name": "r",
+ "options": {"tty": {"owner": "caller"}},
+ "tasks": [{"name": "t", "options": {"tty": {"owner": "target"}, "umask": "022"}}]
+ }]
+ });
+ let before = document.clone();
+ Migration::migrate_from(
+ &Version::new(4, 1, 0),
+ &PACKAGE_VERSION,
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(document, before, "the upgrade keeps the option");
+
+ // 4.1.0 always leaves the terminal to the caller
+ Migration::migrate_from(
+ &PACKAGE_VERSION,
+ &Version::new(4, 1, 0),
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(document["options"], json!({"timeout": {"type": "tty"}}));
+ assert_eq!(document["roles"][0]["options"], json!({}));
+ assert_eq!(
+ document["roles"][0]["tasks"][0]["options"],
+ json!({"umask": "022"})
+ );
+ }
+
+ #[test]
+ fn test_groups_from_is_removed_down() {
+ let task = |cred: Value| json!({"name": "t", "cred": cred});
+ let mut document = json!({
+ "roles": [{
+ "name": "r",
+ "tasks": [
+ task(json!({"setuid": "nobody", "setgid": {"from": "caller"}})),
+ task(json!({"setgid": {"default": "none", "add": [["adm"]], "from": "caller"}})),
+ task(json!({"setgid": {"default": "all", "from": "target"}})),
+ task(json!({"setgid": {"default": "none", "fallback": ["adm"], "from": "target"}})),
+ task(json!({"setgid": "adm"}))
+ ]
+ }, {
+ // the short keys of the CBOR format
+ "name": "c",
+ "t": [{"name": "t", "i": {"g": {"d": 0, "o": "caller"}}}]
+ }]
+ });
+ let before = document.clone();
+ Migration::migrate_from(
+ &Version::new(4, 1, 0),
+ &PACKAGE_VERSION,
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(document, before, "the upgrade writes no from");
+
+ Migration::migrate_from(
+ &PACKAGE_VERSION,
+ &Version::new(4, 1, 0),
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ let creds: Vec<&Value> = document["roles"][0]["tasks"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .map(|task| &task["cred"])
+ .collect();
+ // nothing else than from: no setgid, 4.1.0 keeps the groups of the caller
+ assert_eq!(creds[0], &json!({"setuid": "nobody"}));
+ assert_eq!(
+ creds[1],
+ &json!({"setgid": {"default": "none", "add": [["adm"]]}})
+ );
+ assert_eq!(creds[2], &json!({"setgid": {"default": "all"}}));
+ assert_eq!(
+ creds[3],
+ &json!({"setgid": {"default": "none", "fallback": ["adm"]}})
+ );
+ assert_eq!(creds[4], &json!({"setgid": "adm"}));
+ assert_eq!(document["roles"][1]["t"][0]["i"], json!({}));
+ }
+
+ #[test]
+ fn test_top_level_alternation_is_grouped_down() {
+ let mut document = json!({
+ "roles": [{
+ "name": "r",
+ "tasks": [{
+ "name": "t",
+ "commands": [
+ "/usr/bin/systemctl ^start|stop$",
+ "/usr/bin/systemctl '^start|restart$'",
+ "/usr/bin/systemctl ^(start|stop) caddy$",
+ "/usr/bin/tail ^-n [0-9]+$",
+ "/usr/bin/apt update"
+ ]
+ }, {
+ "name": "selector",
+ "commands": {"default": "none", "del": ["/usr/bin/kill ^-9|-KILL$"]}
+ }]
+ }, {
+ // the short keys of the CBOR format
+ "name": "c",
+ "t": [{"name": "t", "c": ["/usr/bin/systemctl ^a|b$"]}]
+ }]
+ });
+ let before = document.clone();
+ Migration::migrate_from(
+ &Version::new(4, 1, 0),
+ &PACKAGE_VERSION,
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(
+ document, before,
+ "the upgrade leaves the commands as written"
+ );
+
+ Migration::migrate_from(
+ &PACKAGE_VERSION,
+ &Version::new(4, 1, 0),
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(
+ document["roles"][0]["tasks"][0]["commands"],
+ json!([
+ "/usr/bin/systemctl ^(?:start|stop)$",
+ "/usr/bin/systemctl ^(?:start|restart)$",
+ "/usr/bin/systemctl ^(start|stop) caddy$",
+ "/usr/bin/tail ^-n [0-9]+$",
+ "/usr/bin/apt update"
+ ])
+ );
+ assert_eq!(
+ document["roles"][0]["tasks"][1]["commands"]["del"],
+ json!(["/usr/bin/kill ^(?:-9|-KILL)$"])
+ );
+ assert_eq!(
+ document["roles"][1]["t"][0]["c"],
+ json!(["/usr/bin/systemctl ^(?:a|b)$"])
+ );
+ }
+
+ #[test]
+ fn test_4_1_0_documents_up_and_down() {
+ let original = json!({
+ "version": "4.1.0",
+ "options": {"env": {"default": "delete", "check": ["LC_*"]}, "path": {"default": "keep-safe"}},
+ "roles": [{"name": "r", "tasks": [{"name": "t", "commands": ["/usr/bin/ls ^.*$"]}]}]
+ });
+ let mut document = original.clone();
+ let migration = migrate_document(&mut document).unwrap().unwrap();
+ assert_eq!(migration.from, Version::new(4, 1, 0));
+ assert_eq!(document["version"], PACKAGE_VERSION.to_string());
+ let mut unchanged = original.clone();
+ unchanged["version"] = document["version"].clone();
+ assert_eq!(
+ document, unchanged,
+ "4.1.0 to 4.2.0 changes nothing but the version"
+ );
+
+ Migration::migrate_from(
+ &PACKAGE_VERSION,
+ &Version::new(4, 1, 0),
+ &mut document,
+ DOCUMENT_MIGRATIONS,
+ )
+ .unwrap();
+ assert_eq!(document["version"], PACKAGE_VERSION.to_string());
+ document["version"] = original["version"].clone();
+ assert_eq!(document, original);
+ }
+
#[test]
fn test_path_behaviors_up_and_down() {
let mut document = json!({
diff --git a/core/src/database/mod.rs b/core/src/database/mod.rs
index eb04fb7a..9adfadbb 100644
--- a/core/src/database/mod.rs
+++ b/core/src/database/mod.rs
@@ -12,6 +12,7 @@ use self::options::EnvKey;
pub mod score;
pub mod actor;
+pub mod command;
pub mod de;
pub mod env;
pub mod migration;
@@ -126,25 +127,26 @@ where
}
fn convert_string_to_duration(s: &str) -> Result, Box> {
- let mut parts = s.split(':');
- //unwrap or error
- if let (Some(hours), Some(minutes), Some(seconds)) = (parts.next(), parts.next(), parts.next())
- {
- let hours: i64 = hours.parse()?;
- let minutes: i64 = minutes.parse()?;
- let seconds: i64 = seconds.parse()?;
- if hours < 0 || minutes < 0 || seconds < 0 {
- return Err("A duration cannot be negative".into());
+ // hh:mm:ss, exactly three fields of digits: a sign is never valid, and would be lost on a
+ // zero field ("-00" reads as 0), and nothing may follow the seconds
+ let fields: Vec<&str> = s.split(':').collect();
+ let [hours, minutes, seconds] = fields.as_slice() else {
+ return Err("Invalid duration format, expected hh:mm:ss".into());
+ };
+ let field = |field: &str| -> Result> {
+ if field.is_empty() || !field.bytes().all(|byte| byte.is_ascii_digit()) {
+ return Err(format!("Invalid duration field `{field}`, expected digits").into());
}
- // checked: a value of the policy must be an error, never a panic of the parser
- let total = hours
- .checked_mul(3600)
- .and_then(|total| total.checked_add(minutes.checked_mul(60)?))
- .and_then(|total| total.checked_add(seconds))
- .ok_or("The duration is too long")?;
- return Ok(Some(jiff::SignedDuration::from_secs(total)));
- }
- Err("Invalid duration format".into())
+ Ok(field.parse()?)
+ };
+ let (hours, minutes, seconds) = (field(hours)?, field(minutes)?, field(seconds)?);
+ // checked: a value of the policy must be an error, never a panic of the parser
+ let total = hours
+ .checked_mul(3600)
+ .and_then(|total| total.checked_add(minutes.checked_mul(60)?))
+ .and_then(|total| total.checked_add(seconds))
+ .ok_or("The duration is too long")?;
+ Ok(Some(jiff::SignedDuration::from_secs(total)))
}
#[cfg(test)]
@@ -167,6 +169,20 @@ mod tests {
] {
assert!(convert_string_to_duration(duration).is_err(), "{duration}");
}
+ // a sign is never valid, not even on a zero field where it would be lost, nor anything
+ // after the seconds
+ for duration in [
+ "-00:00:01",
+ "+00:00:01",
+ "00:-0:01",
+ "00:05:00:00",
+ "00:05:00:junk",
+ "00::05",
+ "00:05",
+ "",
+ ] {
+ assert!(convert_string_to_duration(duration).is_err(), "{duration}");
+ }
}
struct IndexSetTester(pub Option>);
diff --git a/core/src/database/options.rs b/core/src/database/options.rs
index 122c5d60..01021c6a 100644
--- a/core/src/database/options.rs
+++ b/core/src/database/options.rs
@@ -1,7 +1,7 @@
use core::panic;
use std::borrow::Cow;
use std::collections::HashMap;
-use std::num::ParseIntError;
+use std::num::{NonZeroU8, ParseIntError};
use std::result::Result;
use std::str::FromStr;
use std::{cell::RefCell, rc::Rc};
@@ -22,8 +22,8 @@ use crate::util::{
AUTHENTICATION, BOUNDING, ENV_CHECK_LIST, ENV_DEFAULT_BEHAVIOR, ENV_DELETE_LIST, ENV_KEEP_LIST,
ENV_OVERRIDE_BEHAVIOR, ENV_PATH_ADD_LIST_SLICE, ENV_PATH_BEHAVIOR, ENV_PATH_REMOVE_LIST_SLICE,
ENV_SET_LIST, HARDENED_ENUM_VALUE_0, HARDENED_ENUM_VALUE_1, HARDENED_ENUM_VALUE_2,
- HARDENED_ENUM_VALUE_3, INFO, PRIVILEGED, TIMEOUT_DURATION, TIMEOUT_MAX_USAGE, TIMEOUT_TYPE,
- UMASK, is_valid_env_name, is_valid_env_pattern,
+ HARDENED_ENUM_VALUE_3, INFO, PASSWORD_DELAY, PASSWORD_TRIES, PRIVILEGED, TIMEOUT_DURATION,
+ TIMEOUT_MAX_USAGE, TIMEOUT_TYPE, TTY_OWNER, UMASK, is_valid_env_name, is_valid_env_pattern,
};
use super::{
@@ -57,6 +57,8 @@ pub enum OptType {
Root,
Bounding,
Timeout,
+ Password,
+ Tty,
Authentication,
ExecInfo,
UMask,
@@ -108,11 +110,95 @@ pub enum TimestampType {
UID,
}
+/// How many times the password is asked, and how long dosr waits after a wrong one.
+///
+/// A level that does not set a field inherits it from the upper levels, down to the build-time
+/// defaults (`RAR_PASSWORD_TRIES`, `RAR_PASSWORD_DELAY`). `tries` is at least 1: 0 would never
+/// let anyone in, or never stop asking.
+#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Default, Builder)]
+pub struct SPassword {
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub tries: Option,
+ #[serde(
+ default,
+ serialize_with = "serialize_duration",
+ deserialize_with = "deserialize_duration",
+ skip_serializing_if = "Option::is_none"
+ )]
+ pub delay: Option,
+ #[serde(default, flatten, skip_serializing_if = "Map::is_empty")]
+ #[builder(default)]
+ pub extra_fields: Map,
+}
+
+/// Who owns the pseudo-terminal that dosr gives to the command.
+///
+/// Its default is the build-time one (`RAR_TTY_OWNER`).
+#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Copy)]
+#[serde(rename_all = "kebab-case")]
+#[repr(u32)]
+pub enum TtyOwner {
+ /// The user who runs dosr. The processes of the user that the command runs as cannot open
+ /// the terminal by its name: a program that does, such as pinentry through `GPG_TTY`, fails.
+ Caller = HARDENED_ENUM_VALUE_0,
+ /// The user that the command runs as, like sudo. Its other processes can then open the
+ /// terminal while the command runs, and read what is typed into it.
+ Target = HARDENED_ENUM_VALUE_1,
+}
+
+impl Default for TtyOwner {
+ fn default() -> Self {
+ TTY_OWNER
+ }
+}
+
+impl TtyOwner {
+ #[must_use]
+ /// # Panics
+ /// Panics if the input string does not match any of the valid ``TtyOwner`` variants.
+ pub const fn const_parse(input: &str) -> Self {
+ match input {
+ _ if eq_str(input, "caller") => Self::Caller,
+ _ if eq_str(input, "target") => Self::Target,
+ _ => panic!("fail to parse TtyOwner"),
+ }
+ }
+}
+
+impl FromStr for TtyOwner {
+ type Err = String;
+
+ fn from_str(s: &str) -> Result {
+ match s {
+ "caller" => Ok(Self::Caller),
+ "target" => Ok(Self::Target),
+ _ => Err(format!(
+ "The owner of the terminal is caller or target: {s}"
+ )),
+ }
+ }
+}
+
+/// The pseudo-terminal of the command, when dosr runs from a terminal.
+///
+/// A level that does not set `owner` inherits it from the upper levels, down to the build-time
+/// default (`RAR_TTY_OWNER`).
+#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Default, Builder)]
+pub struct STty {
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub owner: Option,
+ #[serde(default, flatten, skip_serializing_if = "Map::is_empty")]
+ #[builder(default)]
+ pub extra_fields: Map,
+}
+
#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Default, Builder)]
pub struct STimeout {
#[serde(default, rename = "type", skip_serializing_if = "Option::is_none")]
pub type_field: Option,
+ // `default`: with `deserialize_with`, serde requires the field, even an `Option`
#[serde(
+ default,
serialize_with = "serialize_duration",
deserialize_with = "deserialize_duration",
skip_serializing_if = "Option::is_none"
@@ -148,6 +234,10 @@ pub struct SPathOptions {
)]
#[builder(with = |v : impl IntoIterator- | { v.into_iter().map(|s| s.to_string()).collect() })]
pub sub: Option>,
+ /// The fields that this version does not know, kept when the policy is saved again
+ #[serde(default, flatten, skip_serializing_if = "Map::is_empty")]
+ #[builder(default)]
+ pub extra_fields: Map,
}
#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Copy)]
@@ -362,6 +452,10 @@ pub struct SWorkdirSet {
)]
#[builder(with = |v : impl IntoIterator
- | { v.into_iter().map(|s| s.to_string()).collect() })]
pub sub: Option>,
+ /// The fields that this version does not know, kept when the policy is saved again
+ #[serde(default, flatten, skip_serializing_if = "Map::is_empty")]
+ #[builder(default)]
+ pub extra_fields: Map,
}
#[derive(Serialize, Deserialize, PartialEq, Eq, Debug, Clone, Copy)]
#[serde(rename_all = "lowercase")]
@@ -581,6 +675,10 @@ pub struct Opt {
#[serde(default, skip_serializing_if = "Option::is_none")]
pub timeout: Option,
#[serde(default, skip_serializing_if = "Option::is_none")]
+ pub password: Option,
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub tty: Option,
+ #[serde(default, skip_serializing_if = "Option::is_none")]
pub umask: Option,
#[serde(default, flatten)]
pub extra_fields: Map,
@@ -599,6 +697,8 @@ impl Opt {
execinfo: Option,
workdir: Option,
timeout: Option,
+ password: Option,
+ tty: Option,
umask: Option,
#[builder(default)] extra_fields: Map,
) -> Self {
@@ -612,6 +712,8 @@ impl Opt {
execinfo,
workdir,
timeout,
+ password,
+ tty,
umask,
extra_fields,
}
@@ -649,6 +751,13 @@ impl Opt {
.maybe_max_usage(TIMEOUT_MAX_USAGE)
.build(),
)
+ .password(
+ SPassword::builder()
+ .tries(PASSWORD_TRIES)
+ .delay(PASSWORD_DELAY)
+ .build(),
+ )
+ .tty(STty::builder().owner(TTY_OWNER).build())
.build()
}
}
@@ -1092,6 +1201,38 @@ impl OptStack {
.map(|timeout| (opt.level, timeout)))
.map(|(_, timeout)| timeout),
)
+ .password(
+ SPassword::builder()
+ .maybe_tries(
+ self.find_in_options(|opt| opt
+ .password
+ .as_ref()
+ .and_then(|password| password.tries)
+ .map(|tries| (opt.level, tries)))
+ .map(|(_, tries)| tries)
+ )
+ .maybe_delay(
+ self.find_in_options(|opt| opt
+ .password
+ .as_ref()
+ .and_then(|password| password.delay)
+ .map(|delay| (opt.level, delay)))
+ .map(|(_, delay)| delay)
+ )
+ .build(),
+ )
+ .tty(
+ STty::builder()
+ .maybe_owner(
+ self.find_in_options(|opt| opt
+ .tty
+ .as_ref()
+ .and_then(|tty| tty.owner)
+ .map(|owner| (opt.level, owner)))
+ .map(|(_, owner)| owner)
+ )
+ .build(),
+ )
.build()
))
}
@@ -1873,4 +2014,126 @@ mod tests {
// This should serialize as just a string, not as a struct
assert_tokens(&umask, &[Token::Str("644")]);
}
+
+ #[test]
+ fn test_timeout_fields_are_optional() {
+ // every field may be left to the upper levels, the duration as the others
+ let timeout: STimeout = serde_json::from_str(r#"{"type": "tty"}"#).unwrap();
+ assert_eq!(timeout.type_field, Some(TimestampType::TTY));
+ assert_eq!(timeout.duration, None);
+ let timeout: STimeout = serde_json::from_str("{}").unwrap();
+ assert_eq!(timeout, STimeout::default());
+ let opt: Opt = serde_json::from_str(r#"{"timeout": {"max_usage": 2}}"#).unwrap();
+ assert_eq!(opt.timeout.unwrap().max_usage, Some(2));
+ }
+
+ #[test]
+ fn test_password_option() {
+ let password: SPassword =
+ serde_json::from_str(r#"{"tries": 2, "delay": "00:00:01"}"#).unwrap();
+ assert_eq!(password.tries, std::num::NonZeroU8::new(2));
+ assert_eq!(password.delay, Some(SignedDuration::from_secs(1)));
+ assert_eq!(
+ serde_json::to_value(&password).unwrap(),
+ serde_json::json!({"tries": 2, "delay": "00:00:01"})
+ );
+ // 0 tries would never let anyone in, or never stop asking; a delay is never negative
+ for invalid in [
+ r#"{"tries": 0}"#,
+ r#"{"tries": 256}"#,
+ r#"{"tries": -1}"#,
+ r#"{"delay": "-00:00:01"}"#,
+ r#"{"delay": "5s"}"#,
+ ] {
+ assert!(
+ serde_json::from_str::(invalid).is_err(),
+ "{invalid} is refused"
+ );
+ }
+ let cbor = cbor4ii::serde::to_vec(Vec::new(), &password).unwrap();
+ let from_cbor: SPassword = cbor4ii::serde::from_slice(&cbor).unwrap();
+ assert_eq!(from_cbor, password);
+ }
+
+ #[test]
+ fn test_password_defaults() {
+ let defaults = Opt::level_default().password.unwrap();
+ assert_eq!(defaults.tries, Some(crate::util::PASSWORD_TRIES));
+ assert_eq!(defaults.delay, Some(crate::util::PASSWORD_DELAY));
+ assert_eq!(crate::util::PASSWORD_TRIES.get(), 3);
+ assert_eq!(crate::util::PASSWORD_DELAY, SignedDuration::from_secs(5));
+ }
+
+ #[test]
+ fn test_tty_option() {
+ let tty: STty = serde_json::from_str(r#"{"owner": "target"}"#).unwrap();
+ assert_eq!(tty.owner, Some(TtyOwner::Target));
+ assert_eq!(
+ serde_json::to_value(&tty).unwrap(),
+ serde_json::json!({"owner": "target"})
+ );
+ let tty: STty = serde_json::from_str(r#"{"owner": "caller", "future": 1}"#).unwrap();
+ assert_eq!(tty.owner, Some(TtyOwner::Caller));
+ assert_eq!(tty.extra_fields.len(), 1);
+ for invalid in [
+ r#"{"owner": "root"}"#,
+ r#"{"owner": "Target"}"#,
+ r#"{"owner": 1}"#,
+ ] {
+ assert!(
+ serde_json::from_str::(invalid).is_err(),
+ "{invalid} is refused"
+ );
+ }
+ let cbor = cbor4ii::serde::to_vec(Vec::new(), &tty).unwrap();
+ let from_cbor: STty = cbor4ii::serde::from_slice(&cbor).unwrap();
+ assert_eq!(from_cbor, tty);
+ assert_eq!("target".parse(), Ok(TtyOwner::Target));
+ assert_eq!("caller".parse(), Ok(TtyOwner::Caller));
+ assert!("unset".parse::().is_err());
+ }
+
+ // the terminal stays with the caller unless the policy or the build says otherwise
+ #[test]
+ fn test_tty_owner_default_and_inheritance() {
+ assert_eq!(crate::util::TTY_OWNER, TtyOwner::Caller);
+ assert_eq!(TtyOwner::default(), crate::util::TTY_OWNER);
+ assert_eq!(
+ Opt::level_default().tty.unwrap().owner,
+ Some(crate::util::TTY_OWNER)
+ );
+ assert_eq!(TtyOwner::const_parse("caller"), TtyOwner::Caller);
+ assert_eq!(TtyOwner::const_parse("target"), TtyOwner::Target);
+ let config = SPolicy::builder()
+ .role(
+ SRole::builder("test")
+ .task(STask::builder(1).build())
+ .task(
+ STask::builder(2)
+ .options(|opt| {
+ opt.tty(STty::builder().owner(TtyOwner::Caller).build())
+ .build()
+ })
+ .build(),
+ )
+ .build(),
+ )
+ .options(|opt| {
+ opt.tty(STty::builder().owner(TtyOwner::Target).build())
+ .build()
+ })
+ .build();
+ let owner = |task| {
+ OptStack::from_task(&config.task("test", task).unwrap())
+ .to_opt()
+ .unwrap()
+ .as_ref()
+ .borrow()
+ .tty
+ .as_ref()
+ .and_then(|tty| tty.owner)
+ };
+ assert_eq!(owner(1), Some(TtyOwner::Target));
+ assert_eq!(owner(2), Some(TtyOwner::Caller));
+ }
}
diff --git a/core/src/database/path.rs b/core/src/database/path.rs
index c3201563..4c2df6c3 100644
--- a/core/src/database/path.rs
+++ b/core/src/database/path.rs
@@ -5,6 +5,7 @@
//! `PATH` of the user.
use indexmap::IndexSet;
+use log::warn;
use crate::{
database::options::PathBehavior,
@@ -56,8 +57,11 @@ impl<'a> ResolvedPath<'a> {
/// The `PATH` of the command, from the `PATH` of the user:
/// - in delete mode, the directories of the `add` list,
- /// - in keep-safe mode, the directories of the `add` list then the absolute directories of
- /// the user's `PATH`, in keep-unsafe mode every directory of the user's `PATH`,
+ /// - in keep-safe mode, the directories of the `add` list then those of the user's `PATH`,
+ /// in keep-unsafe mode every directory of the user's `PATH`,
+ /// - a relative directory (`.`, an empty one, `bin`) is the working directory of the command,
+ /// which the user chooses: only the keep-unsafe mode keeps it, from the policy as from the
+ /// user, and a relative directory of the policy that is left out is logged,
/// - the directories of the `sub` list are always removed, and each directory appears once.
///
/// The directories of the policy come first, so they win over those of the user.
@@ -70,7 +74,13 @@ impl<'a> ResolvedPath<'a> {
};
let keep_relative = self.behavior.is_keep_unsafe();
let mut path: IndexSet<&str> = IndexSet::new();
- path.extend(self.add.iter().copied());
+ path.extend(self.add.iter().copied().filter(|dir| {
+ let kept = keep_relative || dir.starts_with('/');
+ if !kept {
+ warn!("The directory {dir:?} of the path option is relative, it is left out");
+ }
+ kept
+ }));
path.extend(
user_path
.iter()
@@ -170,6 +180,27 @@ mod tests {
);
}
+ #[test]
+ fn test_relative_directories_only_in_keep_unsafe() {
+ let path = |behavior| ResolvedPath {
+ behavior,
+ add: IndexSet::from(["/sbin", ".", "", "bin"]),
+ sub: IndexSet::new(),
+ };
+ let user_path = ["/usr/bin", "", ".", "tools"];
+ // the relative directories of the policy and of the user are left out, the empty one
+ // (the working directory too) included
+ assert_eq!(path(PathBehavior::Delete).final_path(&user_path), ["/sbin"]);
+ assert_eq!(
+ path(PathBehavior::KeepSafe).final_path(&user_path),
+ ["/sbin", "/usr/bin"]
+ );
+ assert_eq!(
+ path(PathBehavior::KeepUnsafe).final_path(&user_path),
+ ["/sbin", ".", "", "bin", "/usr/bin", "tools"]
+ );
+ }
+
#[test]
fn test_inheriting_level_extends_the_lists() {
let levels = [
diff --git a/core/src/database/ser.rs b/core/src/database/ser.rs
index 0c86fd33..e71ffa26 100644
--- a/core/src/database/ser.rs
+++ b/core/src/database/ser.rs
@@ -141,7 +141,10 @@ impl Serialize for SSetgidSet {
S: serde::Serializer,
{
if let Some(fallback) = self.fallback.as_ref().filter(|_| {
- self.default_behavior.is_none() && self.sub.is_empty() && self.add.is_empty()
+ self.default_behavior.is_none()
+ && self.sub.is_empty()
+ && self.add.is_empty()
+ && self.from.is_none()
}) {
serializer.serialize_some(fallback)
} else if serializer.is_human_readable() {
@@ -156,6 +159,9 @@ impl Serialize for SSetgidSet {
if !self.sub.is_empty() {
map.serialize_entry("del", &self.sub)?;
}
+ if let Some(from) = &self.from {
+ map.serialize_entry("from", from)?;
+ }
map.end()
} else {
let mut map = serializer.serialize_map(None)?;
@@ -169,6 +175,9 @@ impl Serialize for SSetgidSet {
if !self.sub.is_empty() {
map.serialize_entry("s", &self.sub)?;
}
+ if let Some(from) = &self.from {
+ map.serialize_entry("o", from)?;
+ }
map.end()
}
}
diff --git a/core/src/database/structs.rs b/core/src/database/structs.rs
index 07464f84..871ed194 100644
--- a/core/src/database/structs.rs
+++ b/core/src/database/structs.rs
@@ -239,8 +239,10 @@ impl From for SUserEither {
}
}
+/// Like the other credentials, a set of users refuses the fields it does not know, as dosr
+/// does: a typo there must not leave a privilege granted.
#[derive(Deserialize, Debug, Clone, Builder, PartialEq, Eq)]
-
+#[serde(deny_unknown_fields)]
pub struct SSetuidSet {
#[serde(
alias = "d",
@@ -346,18 +348,34 @@ impl From for SGroupsEither {
}
}
+/// Whose groups the command gets when the task does not force them and the user does not choose
+/// any with `-g`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum GroupsFrom {
+ /// The groups of the user that the command runs as, as a login gives them: its primary group
+ /// and the groups that list it as a member
+ #[default]
+ Target,
+ /// The groups of the user who runs dosr
+ Caller,
+}
+
#[derive(Debug, Clone, Builder, PartialEq, Eq)]
pub struct SSetgidSet {
#[builder(start_fn)]
pub default_behavior: SetBehavior,
- /// The groups when the user does not choose any with `-g`. Without it, `-g` is required,
- /// or with the `all` default, the groups of the caller are kept.
+ /// The groups when the user does not choose any with `-g`. Without it, the groups that
+ /// `from` names; without `from` either, `-g` is required with the `none` default, and the
+ /// groups of the target user are taken with the `all` default.
#[builder(into)]
pub fallback: Option,
#[builder(default, with = FromIterator::from_iter)]
pub add: Vec,
#[builder(default, with = FromIterator::from_iter)]
pub sub: Vec,
+ /// Whose groups the command gets without `-g` and without `fallback`
+ pub from: Option,
}
#[derive(PartialEq, Eq, Debug, Builder, Default)]
@@ -926,6 +944,8 @@ mod tests {
let options = binding.as_ref().borrow();
let env = &options.env.as_ref().unwrap();
assert_eq!(env.extra_fields.get("unknown").unwrap(), "unknown");
+ let path = options.path.as_ref().unwrap();
+ assert_eq!(path.extra_fields.get("unknown").unwrap(), "unknown");
assert_eq!(options.extra_fields.get("unknown").unwrap(), "unknown");
let timeout = options.timeout.as_ref().unwrap();
assert_eq!(timeout.extra_fields.get("unknown").unwrap(), "unknown");
@@ -966,6 +986,50 @@ mod tests {
assert_eq!(commands.extra_fields.get("unknown").unwrap(), "unknown");
}
+ #[test]
+ fn test_credentials_refuse_unknown_fields() {
+ // a typo in what grants privileges is an error, as in dosr
+ assert!(
+ serde_json::from_str::(
+ r#"{"default": "all", "fallback": "root", "fallbak": "x"}"#
+ )
+ .is_err()
+ );
+ assert!(
+ serde_json::from_str::(
+ r#"{"default": "all", "fallback": ["root"], "sbu": ["adm"]}"#
+ )
+ .is_err()
+ );
+ assert!(
+ serde_json::from_str::(r#"{"default": "all", "sbu": ["SYS_ADMIN"]}"#)
+ .is_err()
+ );
+ let setuid: SSetuidSet =
+ serde_json::from_str(r#"{"default": "all", "fallback": "root", "add": ["daemon"]}"#)
+ .unwrap();
+ let mut cbor = Vec::new();
+ cbor4ii::serde::to_writer(&mut cbor, &setuid).unwrap();
+ let back: SSetuidSet = cbor4ii::serde::from_slice(&cbor).unwrap();
+ assert_eq!(back, setuid);
+ }
+
+ #[test]
+ fn test_unknown_fields_of_sets_survive_a_round_trip() {
+ use crate::{RemoteStorageSettings, SettingsContent, database::options::SWorkdirSet};
+ let workdir: SWorkdirSet =
+ serde_json::from_str(r#"{"default": "all", "future": 1}"#).unwrap();
+ assert_eq!(serde_json::to_value(&workdir).unwrap()["future"], 1);
+ let storage: SettingsContent = serde_json::from_str(
+ r#"{"method": "json", "settings": {"path": "/p", "future": 2}, "future": 1}"#,
+ )
+ .unwrap();
+ let storage = serde_json::to_value(&storage).unwrap();
+ assert_eq!(storage["future"], 1);
+ assert_eq!(storage["settings"]["future"], 2);
+ let _: RemoteStorageSettings = serde_json::from_value(storage["settings"].clone()).unwrap();
+ }
+
#[allow(clippy::too_many_lines)]
#[test]
fn test_deserialize_alias() {
diff --git a/core/src/file.rs b/core/src/file.rs
index c12504bf..6ba2d287 100644
--- a/core/src/file.rs
+++ b/core/src/file.rs
@@ -5,6 +5,7 @@ use std::{
fmt::Debug,
fs::{File, OpenOptions},
io::{self, BufReader, Seek},
+ os::unix::fs::OpenOptionsExt,
path::{Path, PathBuf},
rc::Rc,
};
@@ -54,6 +55,19 @@ pub struct LockedSettingsFile
pub data: T,
/// The migration applied to the document when it was loaded, until it is saved.
migration: Option,
+ /// The data as loaded, or as last saved: a file whose data is the same is not written
+ /// again. `None` when the data did not come from the file.
+ saved: Option,
+}
+
+/// How a policy file is opened to be written. A new file is only readable and writable by its
+/// owner (the umask can only remove more), like the files of the installers: the policy must not
+/// be readable, nor writable, by other users (see `check_others_permissions`). An existing file
+/// keeps its owner and mode, since saving rewrites it in place.
+fn write_options() -> OpenOptions {
+ let mut options = OpenOptions::new();
+ options.read(true).write(true).create(true).mode(0o600);
+ options
}
/// This opens, deserialize and locks a settings file, and keeps the file descriptor open to keep the lock
@@ -79,12 +93,7 @@ impl LockedSettingsFile {
where
S: AsRef,
{
- Self::open(
- path,
- OpenOptions::new().read(true).write(true).create(true),
- true,
- data_loader,
- )
+ Self::open(path, &write_options(), true, data_loader)
}
/// # Errors
@@ -105,9 +114,11 @@ impl LockedSettingsFile {
nix::fcntl::FlockArg::LockExclusive,
)?;
+ let data = data_loader(&path, &file)?;
Ok(Self {
path: path.as_ref().to_path_buf(),
- data: data_loader(&path, &file)?,
+ saved: serde_json::to_value(&data).ok(),
+ data,
fd: file,
migration: None,
})
@@ -123,6 +134,13 @@ impl LockedSettingsFile {
load_data()
}
+ /// Whether the data differs from what the file holds: changed since it was loaded or saved,
+ /// or not loaded from the file.
+ #[must_use]
+ pub fn changed(&self) -> bool {
+ self.saved.is_none() || self.saved != serde_json::to_value(&self.data).ok()
+ }
+
/// # Errors
/// Returns an error if the file cannot be written
/// due to a lock, permission error or writing error
@@ -150,6 +168,7 @@ impl LockedSettingsFile {
debug!("Wrote config file");
}
self.migration = None;
+ self.saved = serde_json::to_value(&self.data).ok();
Ok(())
}
@@ -184,10 +203,13 @@ pub struct FileSettings {
///# Errors
/// Returns an error if any of the files cannot be opened or locked
#[builder(with = |path: PathBuf,config : RootSettings| -> Result<_, Box> {
- Ok(LockedSettingsFile::open_write(path, |_, _| {
+ let mut root = LockedSettingsFile::open_write(path, |_, _| {
let versioned: Versioning = Versioning::new(config.clone());
Ok(versioned)
- })?)
+ })?;
+ // made from these settings, not read from the file: it is written by the next save
+ root.saved = None;
+ Ok(root)
})]
root: LockedRootSettings,
/// Policy files of a directory that could not be loaded, with the reason.
@@ -228,7 +250,7 @@ impl FileSettings {
rar_cfg_path,
rar_cfg_data_path,
rar_cfg_type,
- OpenOptions::new().read(true).write(true).create(true),
+ &write_options(),
true,
)
}
@@ -247,12 +269,7 @@ impl FileSettings {
where
P: AsRef,
{
- Self::load_policy_file(
- cfg_type,
- OpenOptions::new().read(true).write(true).create(true),
- true,
- cfg_path,
- )
+ Self::load_policy_file(cfg_type, &write_options(), true, cfg_path)
}
/// # Errors
/// Returns an error if any of the files cannot be opened, deserialized or locked
@@ -455,9 +472,11 @@ impl FileSettings {
})
}) {
// Open the new file with the new path
- let new_root = LockedSettingsFile::open_write(path, |_, _| {
+ let mut new_root = LockedSettingsFile::open_write(path, |_, _| {
Ok(Versioning::new(self.root.data.data.clone()))
})?;
+ // the file at the new path does not hold these settings yet
+ new_root.saved = None;
debug!(
"Moved root settings to new path: {}",
new_root.path.display()
@@ -465,7 +484,11 @@ impl FileSettings {
drop(std::mem::replace(&mut self.root, new_root));
}
- let mut has_errors = if let Err(e) = self.root.save(RAR_CFG_TYPE, immutable) {
+ // only the files that changed: the others are not rewritten (in the typed form of the
+ // actors, without their immutable flag for a while...)
+ let mut has_errors = if !self.root.changed() {
+ false
+ } else if let Err(e) = self.root.save(RAR_CFG_TYPE, immutable) {
error!("Failed to save root settings: {e}");
true
} else {
@@ -473,7 +496,7 @@ impl FileSettings {
false
};
- for config in &mut self.map {
+ for config in self.map.iter_mut().filter(|config| config.changed()) {
if let Err(e) = config.save(self.root.data.data.storage.method, immutable) {
error!(
"Failed to save settings for {}: {}",
@@ -565,6 +588,20 @@ impl FileSettings {
pub fn get_policies(&self) -> Vec<&Rc>> {
self.map.iter().map(|config| &config.data.data).collect()
}
+
+ /// The path of the root file.
+ #[must_use]
+ pub fn root_path(&self) -> &Path {
+ &self.root.path
+ }
+
+ /// The policy files apart from the root file (those of a policy directory, or the one file
+ /// that the root file names), with their path.
+ pub fn policy_files(&self) -> impl Iterator
- >)> {
+ self.map
+ .iter()
+ .map(|config| (config.path.as_path(), &config.data.data))
+ }
}
#[cfg(test)]
@@ -1341,6 +1378,56 @@ mod tests {
assert!(!content.contains("oldest_role"));
}
+ /// A path in the temporary directory that does not exist yet, removed when dropped.
+ fn new_temp_path(name: &str) -> (PathBuf, impl Drop) {
+ let path = std::env::temp_dir().join(format!("{name}_{}", std::process::id()));
+ let _ = std::fs::remove_file(&path);
+ let cleanup = path.clone();
+ (
+ path,
+ defer(move || {
+ let _ = std::fs::remove_file(&cleanup);
+ }),
+ )
+ }
+
+ #[test]
+ fn test_new_policy_files_are_private() {
+ use std::os::unix::fs::PermissionsExt;
+ let (root_file, _cleanup_root) = new_temp_path("rar_new_root_file");
+ let mut locked =
+ LockedSettingsFile::open_write(&root_file, |_, _| Ok(RootSettings::default())).unwrap();
+ locked.save(StorageMethod::JSON, false).unwrap();
+ drop(locked);
+ let (policy_file, _cleanup_policy) = new_temp_path("rar_new_policy_file");
+ // the new file is empty, so reading it fails, but the file is created
+ assert!(FileSettings::write_policy(&policy_file, StorageMethod::JSON).is_err());
+ for path in [&root_file, &policy_file] {
+ let mode = std::fs::metadata(path).unwrap().permissions().mode();
+ // never more than 0600, whatever the umask
+ assert_eq!(mode & 0o077, 0, "{}: {mode:o}", path.display());
+ }
+ }
+
+ #[test]
+ fn test_saving_keeps_the_owner_and_mode() {
+ use std::os::unix::fs::{MetadataExt, PermissionsExt};
+ let (path, _cleanup) = new_temp_path("rar_saved_root_file");
+ std::fs::write(&path, b"{}").unwrap();
+ std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o640)).unwrap();
+ let before = std::fs::metadata(&path).unwrap();
+ let mut locked =
+ LockedSettingsFile::open_write(&path, |_, _| Ok(RootSettings::default())).unwrap();
+ locked.save(StorageMethod::JSON, false).unwrap();
+ drop(locked);
+ let after = std::fs::metadata(&path).unwrap();
+ // rewritten in place: the same file, with its owner and mode
+ assert_eq!(after.ino(), before.ino());
+ assert_eq!((after.uid(), after.gid()), (before.uid(), before.gid()));
+ assert_eq!(after.permissions().mode() & 0o7777, 0o640);
+ assert!(after.len() > 2);
+ }
+
#[test]
fn test_save_all_with_directory_storage() {
let test_file = "/tmp/test_save_all_with_directory_storage.json";
diff --git a/core/src/lib.rs b/core/src/lib.rs
index 7d4977b3..c36aed85 100644
--- a/core/src/lib.rs
+++ b/core/src/lib.rs
@@ -60,6 +60,66 @@ use konst::result;
use libc::dev_t;
use nix::unistd::{Gid, Group, Pid, Uid, User, getgroups};
use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+
+/// [`println!`] that ignores write errors: a privileged program must not panic because its
+/// output is a closed pipe (`dosr -i | true` gets `EPIPE`, since Rust ignores `SIGPIPE`).
+#[macro_export]
+macro_rules! println_ignore_io_error {
+ ($($tt:tt)*) => {{
+ use ::std::io::Write as _;
+ let _ = ::std::writeln!(::std::io::stdout(), $($tt)*);
+ }};
+}
+
+/// [`print!`] that ignores write errors, see [`println_ignore_io_error`].
+#[macro_export]
+macro_rules! print_ignore_io_error {
+ ($($tt:tt)*) => {{
+ use ::std::io::Write as _;
+ let _ = ::std::write!(::std::io::stdout(), $($tt)*);
+ }};
+}
+
+/// [`eprintln!`] that ignores write errors, see [`println_ignore_io_error`].
+#[macro_export]
+macro_rules! eprintln_ignore_io_error {
+ ($($tt:tt)*) => {{
+ use ::std::io::Write as _;
+ let _ = ::std::writeln!(::std::io::stderr(), $($tt)*);
+ }};
+}
+
+// `println!` and the like panic when the output is a closed pipe (`EPIPE`, since Rust ignores
+// `SIGPIPE`): outside the tests, the `*_ignore_io_error` macros of rootasrole-core are used.
+#[cfg(not(test))]
+#[allow(unused_macros)]
+macro_rules! println {
+ ($($tt:tt)*) => {
+ compile_error!("println! panics on EPIPE, use println_ignore_io_error!")
+ };
+}
+#[cfg(not(test))]
+#[allow(unused_macros)]
+macro_rules! print {
+ ($($tt:tt)*) => {
+ compile_error!("print! panics on EPIPE, use print_ignore_io_error!")
+ };
+}
+#[cfg(not(test))]
+#[allow(unused_macros)]
+macro_rules! eprintln {
+ ($($tt:tt)*) => {
+ compile_error!("eprintln! panics on EPIPE, use eprintln_ignore_io_error!")
+ };
+}
+#[cfg(not(test))]
+#[allow(unused_macros)]
+macro_rules! eprint {
+ ($($tt:tt)*) => {
+ compile_error!("eprint! panics on EPIPE, use eprintln_ignore_io_error!")
+ };
+}
//pub mod api;
pub mod database;
@@ -125,6 +185,10 @@ pub struct RemoteStorageSettings {
#[cfg(feature = "sgbd")]
#[serde(skip_serializing_if = "Option::is_none")]
pub properties: Option,
+ /// The fields that this version does not know, kept when the policy is saved again
+ #[serde(default, flatten, skip_serializing_if = "Map::is_empty")]
+ #[builder(default)]
+ pub extra_fields: Map,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
@@ -143,6 +207,10 @@ pub struct SettingsContent {
#[cfg(feature = "ldap")]
#[serde(skip_serializing_if = "Option::is_none")]
pub ldap: Option,
+ /// The fields that this version does not know, kept when the policy is saved again
+ #[serde(default, flatten, skip_serializing_if = "Map::is_empty")]
+ #[builder(default)]
+ pub extra_fields: Map,
}
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
diff --git a/core/src/log.rs b/core/src/log.rs
index eb4759f5..01e50bea 100644
--- a/core/src/log.rs
+++ b/core/src/log.rs
@@ -2,7 +2,7 @@
#[allow(clippy::unnecessary_wraps)] // Same signature as non debug.
/// # Errors
/// Returns an error if the logger fails to initialize
-pub fn subsribe(_: &str) -> std::io::Result<()> {
+pub fn subscribe(_: &str) -> std::io::Result<()> {
env_logger::Builder::from_default_env()
.filter_level(log::LevelFilter::Trace)
.format_module_path(true)
@@ -11,7 +11,7 @@ pub fn subsribe(_: &str) -> std::io::Result<()> {
}
#[cfg(not(debug_assertions))]
-pub fn subsribe(tool: &str) -> std::io::Result<()> {
+pub fn subscribe(tool: &str) -> std::io::Result<()> {
use log::LevelFilter;
use std::ffi::CString;
@@ -79,3 +79,12 @@ impl log::Log for CustomSysLogger {
fn flush(&self) {}
}
+
+/// The former, misspelled name of [`subscribe`], kept for the users of rootasrole-core 4.1.
+///
+/// # Errors
+/// As [`subscribe`].
+#[deprecated(since = "4.2.0", note = "use subscribe")]
+pub fn subsribe(tool: &str) -> std::io::Result<()> {
+ subscribe(tool)
+}
diff --git a/core/src/util.rs b/core/src/util.rs
index 88dc3c90..954fa59f 100644
--- a/core/src/util.rs
+++ b/core/src/util.rs
@@ -20,10 +20,11 @@ use nix::{
unistd::{Gid, Group},
};
use serde::{Deserialize, Serialize};
+use std::num::NonZeroU8;
use crate::database::options::{
EnvBehavior, PathBehavior, SAuthentication, SBounding, SInfo, SPrivileged, SUMask,
- TimestampType, WorkdirBehavior,
+ TimestampType, TtyOwner, WorkdirBehavior,
};
#[cfg(feature = "finder")]
@@ -58,6 +59,9 @@ pub(super) const RAR_CFG_IMMUTABLE: bool = false;
#[cfg(not(debug_assertions))]
pub(super) const RAR_CFG_IMMUTABLE: bool = eq_str(env!("RAR_CFG_IMMUTABLE"), "true");
+/// The policy file that chsr edits in a policy directory, when no file is named: the file that
+/// the installers write there.
+pub const DEFAULT_POLICY_FILE: &str = "default.json";
pub const RAR_CFG_TYPE: StorageMethod = StorageMethod::const_parse(env!("RAR_CFG_TYPE"));
pub const ENV_PATH_BEHAVIOR: PathBehavior = PathBehavior::const_parse(env!("RAR_PATH_DEFAULT"));
@@ -141,6 +145,26 @@ pub const TIMEOUT_MAX_USAGE: Option = match option_env!("RAR_TIMEOUT_MAX_US
None => None,
};
+//=== SPassword ===
+
+/// How many times the password is asked before dosr gives up (`RAR_PASSWORD_TRIES`). A value
+/// that is not a number from 1 to 255, or a missing build variable, stops the build.
+pub const PASSWORD_TRIES: NonZeroU8 = match u8::from_str_radix(env!("RAR_PASSWORD_TRIES"), 10) {
+ Ok(n) => match NonZeroU8::new(n) {
+ Some(n) => n,
+ None => panic!("RAR_PASSWORD_TRIES must be at least 1"),
+ },
+ Err(_) => panic!("RAR_PASSWORD_TRIES must be a number from 1 to 255"),
+};
+
+/// How long dosr waits after a wrong password (`RAR_PASSWORD_DELAY`, hh:mm:ss). A value that is
+/// not a duration, or a missing build variable, stops the build.
+pub const PASSWORD_DELAY: SignedDuration =
+ match convert_string_to_duration(env!("RAR_PASSWORD_DELAY")) {
+ Ok(delay) => delay,
+ Err(_) => panic!("RAR_PASSWORD_DELAY must be a duration written hh:mm:ss"),
+ };
+
pub const WORKDIR_BEHAVIOR: WorkdirBehavior =
assert_valid_workdir_behavior(WorkdirBehavior::const_parse(env!("RAR_WORKDIR_BEHAVIOR")));
@@ -183,6 +207,10 @@ pub const UMASK: SUMask = SUMask(result::unwrap_or!(
pub const INFO: SInfo = SInfo::const_parse(env!("RAR_EXEC_INFO_DISPLAY"));
+/// Who owns the terminal of a command run as another user, when the policy does not say it
+/// (`RAR_TTY_OWNER`): `caller`, or `target` like sudo. A value that is neither stops the build.
+pub const TTY_OWNER: TtyOwner = TtyOwner::const_parse(env!("RAR_TTY_OWNER"));
+
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Copy)]
#[serde(rename_all = "lowercase")]
#[repr(u8)]
@@ -714,8 +742,12 @@ pub fn match_single_path(cmd_path: &Path, role_path: &str) -> CmdMin {
if cmd_path == Path::new(role_path) {
match_status.set_matching();
} else {
+ // compiling a pattern costs about 10 µs, for each command of each task of the policy
#[cfg(feature = "glob")]
- if glob_matches(role_path, cmd_path) {
+ if is_glob_pattern(role_path)
+ && starts_like(role_path, cmd_path)
+ && glob_matches(role_path, cmd_path)
+ {
use crate::database::score::CmdOrder;
match_status.set_matching();
match_status.union_order(CmdOrder::WildcardPath);
@@ -730,6 +762,24 @@ pub fn match_single_path(cmd_path: &Path, role_path: &str) -> CmdMin {
match_status
}
+/// Whether `pattern` has a character that globset reads specially. Without any, it only matches
+/// the path written the same way, which the comparison of paths already found.
+#[cfg(all(feature = "finder", feature = "glob"))]
+fn is_glob_pattern(pattern: &str) -> bool {
+ pattern.contains(['*', '?', '[', '{', '\\'])
+}
+
+/// Whether `path` starts with the characters of `pattern` before its first special one, which
+/// globset matches as they are: otherwise the pattern cannot match, and is not compiled.
+#[cfg(all(feature = "finder", feature = "glob"))]
+fn starts_like(pattern: &str, path: &Path) -> bool {
+ use std::os::unix::ffi::OsStrExt;
+ let literal = pattern
+ .find(['*', '?', '[', '{', '\\'])
+ .map_or(pattern, |special| &pattern[..special]);
+ path.as_os_str().as_bytes().starts_with(literal.as_bytes())
+}
+
#[cfg(all(feature = "finder", feature = "glob"))]
fn glob_matches(pattern: &str, path: &Path) -> bool {
use std::path::Component;
@@ -1009,6 +1059,30 @@ mod test {
assert!(!matches("/usr/bin/./ls", "/usr/bin/*"));
// an invalid pattern matches nothing
assert!(!matches("/usr/bin/ls", "/usr/bin/[ls"));
+ // the characters of globset make a pattern, `\` escapes the next one
+ for pattern in [
+ "/usr/bin/*",
+ "/usr/bin/l?",
+ "/usr/bin/[lc]s",
+ "/usr/bin/{ls,cat}",
+ ] {
+ assert!(is_glob_pattern(pattern), "{pattern}");
+ }
+ assert!(is_glob_pattern("/usr/bin/a\\*"));
+ assert!(matches("/usr/bin/a*", "/usr/bin/a\\*"));
+ assert!(!matches("/usr/bin/ab", "/usr/bin/a\\*"));
+ // the characters before the first special one must start the path
+ assert!(starts_like(
+ "/usr/bin/python3.*",
+ Path::new("/usr/bin/python3.12")
+ ));
+ assert!(!starts_like("/usr/bin/true5*", Path::new("/usr/bin/true")));
+ assert!(!matches("/usr/bin/true", "/usr/bin/true5*"));
+ assert!(starts_like("/usr/bin/{ls,cat}", Path::new("/usr/bin/cat")));
+ // without them, a path is not compiled and matches only itself
+ assert!(!is_glob_pattern("/usr/bin/true1"));
+ assert!(!matches("/usr/bin/true", "/usr/bin/true1"));
+ assert!(!matches("/usr/bin/true1", "/usr/bin/true"));
}
#[test]
diff --git a/exec/src/monitor/backchannel.rs b/exec/src/monitor/backchannel.rs
index 997787b4..f2151828 100644
--- a/exec/src/monitor/backchannel.rs
+++ b/exec/src/monitor/backchannel.rs
@@ -3,10 +3,14 @@
use log::{trace, warn};
use rkyv::{Archive, Deserialize, Serialize};
use std::io::{self, Write};
+use std::os::fd::AsRawFd;
use std::os::unix::net::UnixStream;
pub const MAX_BACKCHANNEL_MESSAGE_SIZE: usize = 64 * 1024;
+/// A frame is the length of the message as a little-endian `u32`, then the message.
+const FRAME_HEADER_SIZE: usize = size_of::();
+
macro_rules! signals {
(core + [$($extra:expr),* $(,)?]) => {
&[
@@ -65,12 +69,16 @@ pub enum MonitorMessage {
Signal(i32),
/// Ready to start
Edge,
+ /// Resume the stopped command, with the pty in its foreground or not
+ Resume { foreground: bool },
}
#[derive(Archive, Serialize, Deserialize, Debug)]
pub enum ParentMessage {
/// Command PID
CommandPid(i32),
+ /// The command was stopped by this signal: suspend dosr, like a shell job
+ CommandStopped(i32),
/// Exit status from the command
ExitStatus(i32),
/// Error during execution
@@ -79,6 +87,8 @@ pub enum ParentMessage {
pub struct Backchannel {
stream: UnixStream,
+ /// The bytes of the frame being read: on a non-blocking socket, a frame can arrive in parts.
+ received: Vec,
}
impl Backchannel {
@@ -90,9 +100,18 @@ impl Backchannel {
pub fn pair() -> io::Result<(Self, Self)> {
let (a, b) = UnixStream::pair()?;
// Keep both as blocking - poll() will notify when data is available
- Ok((Self { stream: a }, Self { stream: b }))
+ Ok((Self::new(a), Self::new(b)))
+ }
+
+ const fn new(stream: UnixStream) -> Self {
+ Self {
+ stream,
+ received: Vec::new(),
+ }
}
+ /// Write a whole frame. It is written at once, and a full non-blocking socket is waited for:
+ /// a frame is never cut, whatever the peer reads in between.
fn write_frame(&mut self, data: &[u8]) -> io::Result<()> {
if data.len() > MAX_BACKCHANNEL_MESSAGE_SIZE {
return Err(io::Error::new(
@@ -102,29 +121,93 @@ impl Backchannel {
}
#[allow(clippy::cast_possible_truncation)]
let len = (data.len() as u32).to_le_bytes();
+ let mut frame = Vec::with_capacity(FRAME_HEADER_SIZE + data.len());
+ frame.extend_from_slice(&len);
+ frame.extend_from_slice(data);
trace!("backchannel: write frame len={}", data.len());
- self.stream.write_all(&len)?;
- self.stream.write_all(data)?;
+ let mut written = 0;
+ while written < frame.len() {
+ match self.stream.write(&frame[written..]) {
+ Ok(0) => return Err(io::Error::from(io::ErrorKind::WriteZero)),
+ Ok(count) => written += count,
+ Err(ref e) if e.kind() == io::ErrorKind::Interrupted => {}
+ Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => self.wait_writable()?,
+ Err(e) => return Err(e),
+ }
+ }
Ok(())
}
+ /// Wait until the socket can be written again.
+ fn wait_writable(&self) -> io::Result<()> {
+ let mut fd = libc::pollfd {
+ fd: self.stream.as_raw_fd(),
+ events: libc::POLLOUT,
+ revents: 0,
+ };
+ loop {
+ // SAFETY: `fd` is one valid pollfd that outlives the call, and the count is 1
+ if unsafe { libc::poll(&raw mut fd, 1, -1) } >= 0 {
+ return Ok(());
+ }
+ let error = io::Error::last_os_error();
+ if error.kind() != io::ErrorKind::Interrupted {
+ return Err(error);
+ }
+ }
+ }
+
+ /// Read one frame. On a non-blocking socket, the bytes read so far are kept and `WouldBlock`
+ /// is returned until the frame is complete. Only the bytes of this frame are read: the next
+ /// one stays in the socket, so that `poll()` still reports it.
fn read_frame(&mut self) -> io::Result> {
use std::io::Read;
- let mut len_buf = [0u8; 4];
- self.stream.read_exact(&mut len_buf)?;
- let len = u32::from_le_bytes(len_buf) as usize;
+ loop {
+ let size = self.frame_size()?;
+ let start = self.received.len();
+ if start == size {
+ trace!("backchannel: read frame len={}", size - FRAME_HEADER_SIZE);
+ let data = self.received.split_off(FRAME_HEADER_SIZE);
+ self.received.clear();
+ return Ok(data);
+ }
+ self.received.resize(size, 0);
+ match self.stream.read(&mut self.received[start..]) {
+ Ok(0) => {
+ self.received.truncate(start);
+ return Err(io::Error::new(
+ io::ErrorKind::UnexpectedEof,
+ "backchannel closed",
+ ));
+ }
+ Ok(count) => self.received.truncate(start + count),
+ Err(e) => {
+ self.received.truncate(start);
+ if e.kind() != io::ErrorKind::Interrupted {
+ return Err(e);
+ }
+ }
+ }
+ }
+ }
+
+ /// The size of the frame being read, header included; the size of the header alone until it
+ /// is read. An invalid length means that the stream cannot be trusted anymore: the bytes read
+ /// so far are dropped.
+ fn frame_size(&mut self) -> io::Result {
+ let Some(header) = self.received.first_chunk::() else {
+ return Ok(FRAME_HEADER_SIZE);
+ };
+ let len = u32::from_le_bytes(*header) as usize;
if len == 0 || len > MAX_BACKCHANNEL_MESSAGE_SIZE {
+ self.received.clear();
warn!("backchannel: invalid frame size {len}");
return Err(io::Error::new(
io::ErrorKind::InvalidData,
format!("invalid backchannel message size: {len} bytes"),
));
}
-
- let mut data = vec![0u8; len];
- trace!("backchannel: read frame len={len}");
- self.stream.read_exact(&mut data)?;
- Ok(data)
+ Ok(FRAME_HEADER_SIZE + len)
}
/// # Errors
@@ -206,7 +289,9 @@ mod tests {
.expect("receive monitor message")
{
MonitorMessage::Signal(signal) => assert_eq!(signal, libc::SIGUSR1),
- MonitorMessage::Edge => panic!("unexpected monitor message"),
+ MonitorMessage::Edge | MonitorMessage::Resume { .. } => {
+ panic!("unexpected monitor message")
+ }
}
monitor
@@ -217,7 +302,9 @@ mod tests {
.expect("receive parent message")
{
ParentMessage::CommandPid(pid) => assert_eq!(pid, 4242),
- ParentMessage::ExitStatus(_) | ParentMessage::Error(_) => {
+ ParentMessage::ExitStatus(_)
+ | ParentMessage::Error(_)
+ | ParentMessage::CommandStopped(_) => {
panic!("unexpected parent message")
}
}
@@ -227,6 +314,33 @@ mod tests {
.expect("keep nonblocking mode configurable");
}
+ #[test]
+ fn backchannel_roundtrips_the_suspend_messages() {
+ let (mut parent, mut monitor) = Backchannel::pair().expect("create backchannel pair");
+
+ monitor
+ .send_parent_message(&ParentMessage::CommandStopped(libc::SIGTSTP))
+ .expect("send the stop");
+ assert!(matches!(
+ parent.recv_parent_message(),
+ Ok(ParentMessage::CommandStopped(libc::SIGTSTP))
+ ));
+
+ for foreground in [true, false] {
+ parent
+ .send_monitor_message(&MonitorMessage::Resume { foreground })
+ .expect("send the resume");
+ match monitor.recv_monitor_message() {
+ Ok(MonitorMessage::Resume {
+ foreground: received,
+ }) => {
+ assert_eq!(received, foreground);
+ }
+ other => panic!("unexpected result {other:?}"),
+ }
+ }
+ }
+
#[test]
fn backchannel_rejects_oversized_frames() {
let (mut parent, _) = Backchannel::pair().expect("create backchannel pair");
@@ -279,4 +393,148 @@ mod tests {
.expect_err("truncated frame must fail gracefully");
assert_eq!(error.kind(), io::ErrorKind::InvalidData);
}
+
+ /// The bytes of one frame, as the sender writes them.
+ fn frame_bytes(msg: &ParentMessage) -> Vec {
+ use std::io::Read;
+ let (mut sender, mut receiver) = Backchannel::pair().expect("create backchannel pair");
+ sender
+ .send_parent_message(msg)
+ .expect("send parent message");
+ drop(sender);
+ let mut frame = Vec::new();
+ receiver
+ .get_mut()
+ .read_to_end(&mut frame)
+ .expect("read the frame");
+ frame
+ }
+
+ // The monitor can be preempted between the length and the payload of a frame: the runner
+ // reads a non-blocking socket and must keep what it already read until the frame is complete.
+ #[test]
+ fn backchannel_keeps_a_frame_split_across_reads() {
+ let frame = frame_bytes(&ParentMessage::ExitStatus(0));
+ let (mut monitor, mut runner) = Backchannel::pair().expect("create backchannel pair");
+ runner.set_nonblocking(true).expect("set nonblocking");
+
+ for split in 1..frame.len() {
+ monitor
+ .get_mut()
+ .write_all(&frame[..split])
+ .expect("write the first part");
+ let error = runner
+ .recv_parent_message()
+ .expect_err("a part of a frame is not a message");
+ assert_eq!(error.kind(), io::ErrorKind::WouldBlock, "split at {split}");
+
+ monitor
+ .get_mut()
+ .write_all(&frame[split..])
+ .expect("write the rest");
+ match runner.recv_parent_message() {
+ Ok(ParentMessage::ExitStatus(status)) => assert_eq!(status, 0),
+ other => panic!("split at {split}: unexpected result {other:?}"),
+ }
+ }
+ }
+
+ #[test]
+ fn backchannel_reads_a_frame_written_byte_by_byte() {
+ let frame = frame_bytes(&ParentMessage::CommandPid(4242));
+ let (mut monitor, mut runner) = Backchannel::pair().expect("create backchannel pair");
+ runner.set_nonblocking(true).expect("set nonblocking");
+
+ let (last, first) = frame.split_last().expect("a frame is not empty");
+ for byte in first {
+ monitor
+ .get_mut()
+ .write_all(std::slice::from_ref(byte))
+ .expect("write one byte");
+ let error = runner
+ .recv_parent_message()
+ .expect_err("a part of a frame is not a message");
+ assert_eq!(error.kind(), io::ErrorKind::WouldBlock);
+ }
+ monitor
+ .get_mut()
+ .write_all(std::slice::from_ref(last))
+ .expect("write the last byte");
+ match runner.recv_parent_message() {
+ Ok(ParentMessage::CommandPid(pid)) => assert_eq!(pid, 4242),
+ other => panic!("unexpected result {other:?}"),
+ }
+ }
+
+ // The monitor handles one message per readable event: reading a frame must not take the
+ // bytes of the next one, or poll would not report them anymore.
+ #[test]
+ fn backchannel_leaves_the_next_frame_in_the_socket() {
+ use std::os::fd::AsRawFd;
+ let (mut runner, mut monitor) = Backchannel::pair().expect("create backchannel pair");
+ monitor.set_nonblocking(true).expect("set nonblocking");
+ runner
+ .send_monitor_message(&MonitorMessage::Signal(libc::SIGUSR1))
+ .expect("send a signal");
+ runner
+ .send_monitor_message(&MonitorMessage::Edge)
+ .expect("send the edge");
+
+ match monitor.recv_monitor_message() {
+ Ok(MonitorMessage::Signal(signal)) => assert_eq!(signal, libc::SIGUSR1),
+ other => panic!("unexpected result {other:?}"),
+ }
+ let mut fd = libc::pollfd {
+ fd: monitor.get_stream().as_raw_fd(),
+ events: libc::POLLIN,
+ revents: 0,
+ };
+ // SAFETY: `fd` is one valid pollfd that outlives the call, and the timeout is zero
+ let ready = unsafe { libc::poll(&raw mut fd, 1, 0) };
+ assert_eq!(ready, 1, "the second frame must still be readable");
+ assert!(matches!(
+ monitor.recv_monitor_message(),
+ Ok(MonitorMessage::Edge)
+ ));
+ }
+
+ // A frame sent on a full non-blocking socket waits for room instead of being cut.
+ #[test]
+ fn backchannel_waits_for_room_when_the_socket_is_full() {
+ use std::io::Read;
+ let (mut monitor, mut runner) = Backchannel::pair().expect("create backchannel pair");
+ monitor.set_nonblocking(true).expect("set nonblocking");
+ runner
+ .get_mut()
+ .set_read_timeout(Some(std::time::Duration::from_secs(10)))
+ .expect("set a read timeout");
+
+ let chunk = [0xffu8; 4096];
+ let mut filled = 0;
+ loop {
+ match monitor.get_mut().write(&chunk) {
+ Ok(written) => filled += written,
+ Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => break,
+ Err(e) => panic!("fill the socket: {e}"),
+ }
+ }
+ // the reader drains the socket only once the frame is being sent on a full socket
+ let reader = std::thread::spawn(move || {
+ std::thread::sleep(std::time::Duration::from_millis(200));
+ let mut filler = vec![0u8; filled];
+ runner
+ .get_mut()
+ .read_exact(&mut filler)
+ .expect("drain the filler");
+ runner.recv_parent_message()
+ });
+
+ monitor
+ .send_parent_message(&ParentMessage::ExitStatus(7))
+ .expect("the frame is sent whole");
+ match reader.join().expect("the reader thread ends") {
+ Ok(ParentMessage::ExitStatus(status)) => assert_eq!(status, 7),
+ other => panic!("unexpected result {other:?}"),
+ }
+ }
}
diff --git a/exec/src/monitor/mod.rs b/exec/src/monitor/mod.rs
index 6e550094..42d913f1 100644
--- a/exec/src/monitor/mod.rs
+++ b/exec/src/monitor/mod.rs
@@ -6,9 +6,9 @@ use std::process::Command;
use crate::event::{EventRegistry, PollEvent, Process};
use crate::orchestrator::{Orchestrator, PreExecContext};
use crate::pty::PtyFollower;
-use crate::signal::{SignalInfo, SignalStream, register_signal_handler};
-use crate::terminal::TerminalExt;
-use libc::{SIGCHLD, SIGKILL};
+use crate::signal::{SignalInfo, SignalStream, register_signal_handler, terminate_process};
+use crate::terminal::{ProcessId, TerminalExt};
+use libc::SIGCHLD;
use log::{debug, error, trace, warn};
pub mod backchannel;
@@ -97,8 +97,7 @@ impl Process for MonitorClosure {
if is_forward_signal_allowed(sig) {
if let Some(pid) = self.command_pid {
if sig == libc::SIGALRM {
- // SAFETY: kill does not access memory, it only sends a signal to the command
- unsafe { libc::kill(pid, libc::SIGKILL) };
+ terminate_process(pid, false);
} else {
// SAFETY: kill does not access memory, it only sends a signal to the command
unsafe { libc::kill(pid, sig) };
@@ -116,7 +115,9 @@ impl Process for MonitorClosure {
registry.set_break(io::Error::from_raw_os_error(0));
}
}
- //Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => { },
+ Ok(MonitorMessage::Resume { foreground }) => self.resume_command(foreground),
+ // A frame arrived in parts: the rest comes with the next readable event.
+ Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {}
Err(e) => {
registry.set_break(e);
}
@@ -127,6 +128,29 @@ impl Process for MonitorClosure {
}
impl MonitorClosure {
+ /// Resume the stopped command once dosr is continued: in the foreground, the pty goes back to
+ /// the process group of the command; in the background, the monitor keeps it.
+ fn resume_command(&self, foreground: bool) {
+ let Some(pid) = self.command_pid else {
+ return;
+ };
+ let pgrp = if foreground {
+ self.command_pgrp
+ } else {
+ self.monitor_pgrp
+ };
+ debug!("monitor: resuming the command (foreground={foreground})");
+ if let Err(e) = self
+ .pty_follower
+ .as_tty()
+ .and_then(|tty| tty.tcsetpgrp(ProcessId::new(pgrp)))
+ {
+ warn!("monitor: cannot give the pty to process group {pgrp}: {e}");
+ }
+ // SAFETY: killpg does not access memory, it only sends a signal to the command's group
+ unsafe { libc::killpg(pid, libc::SIGCONT) };
+ }
+
fn handle_signal(&mut self, info: SignalInfo, registry: &mut EventRegistry) {
debug!("monitor: got signal {} from pid {}", info.signal, info.pid);
if info.signal == SIGCHLD {
@@ -137,13 +161,18 @@ impl MonitorClosure {
unsafe { libc::waitpid(pid, &raw mut status, libc::WNOHANG | libc::WUNTRACED) };
if res > 0 {
if libc::WIFSTOPPED(status) {
- warn!("monitor: command stopped with {}", libc::WSTOPSIG(status));
- let _ =
- self.backchannel
- .send_parent_message(&ParentMessage::Error(format!(
- "Command stopped with signal {}",
- libc::WSTOPSIG(status)
- )));
+ let signal = libc::WSTOPSIG(status);
+ debug!("monitor: command stopped with {signal}");
+ // The command may have given the pty to another of its process groups:
+ // that group gets the pty back when the command is resumed.
+ if let Ok(pgrp) = self.pty_follower.as_tty().and_then(|tty| tty.tcgetpgrp())
+ && pgrp.inner() != self.monitor_pgrp
+ {
+ self.command_pgrp = pgrp.inner();
+ }
+ let _ = self
+ .backchannel
+ .send_parent_message(&ParentMessage::CommandStopped(signal));
return;
}
@@ -167,8 +196,7 @@ impl MonitorClosure {
if is_forward_signal_allowed(info.signal) {
debug!("monitor: forwarding signal {}", info.signal);
if info.signal == libc::SIGALRM {
- // SAFETY: kill does not access memory, it only sends a signal to the command
- unsafe { libc::kill(pid, libc::SIGKILL) };
+ terminate_process(pid, false);
} else {
// SAFETY: kill does not access memory, it only sends a signal to the command
unsafe { libc::kill(pid, info.signal) };
@@ -401,10 +429,9 @@ pub fn exec_monitor_process(
monitor.monitor_pgrp
);
- // Cleanup
+ // Cleanup: the command still runs although the monitor is done (the runner is gone)
if let Some(pid) = monitor.command_pid {
- // SAFETY: kill does not access memory, it only sends a signal to the command
- unsafe { libc::kill(pid, SIGKILL) };
+ terminate_process(pid, true);
let mut status = 0;
// SAFETY: waitpid only writes the exit status through a pointer to a local integer
unsafe { libc::waitpid(pid, &raw mut status, 0) };
diff --git a/exec/src/pipe.rs b/exec/src/pipe.rs
index 00f6d3f9..946a499b 100644
--- a/exec/src/pipe.rs
+++ b/exec/src/pipe.rs
@@ -90,6 +90,11 @@ impl Pipe {
self.background = true;
}
+ pub fn enable_input(&mut self, registry: &mut EventRegistry) {
+ self.buffer_lr.read_handle.resume(registry);
+ self.background = false;
+ }
+
pub fn resume_events(&mut self, registry: &mut EventRegistry) {
if !self.background {
self.buffer_lr.read_handle.resume(registry);
diff --git a/exec/src/pty.rs b/exec/src/pty.rs
index 119aca91..9686236f 100644
--- a/exec/src/pty.rs
+++ b/exec/src/pty.rs
@@ -139,6 +139,19 @@ impl PtyFollower {
pub fn try_clone(&self) -> io::Result {
self.file.try_clone().map(|file| Self { file })
}
+
+ /// Give the terminal to `uid`, keeping its group (`tty` when devpts is mounted with
+ /// `gid=5`) and its mode. Unlike sudo-rs, which changes it by its path
+ /// (`src/exec/use_pty/parent.rs`, `get_pty`), it is changed through the open descriptor.
+ ///
+ /// # Errors
+ /// Returns an error if the caller may not change the owner: it needs `CAP_CHOWN`, unless
+ /// `uid` already owns the terminal.
+ pub fn set_owner(&self, uid: libc::uid_t) -> io::Result<()> {
+ // a gid of -1 keeps the group
+ // SAFETY: fchown does not access memory, the descriptor is owned by `self.file`
+ cerr(unsafe { libc::fchown(self.file.as_raw_fd(), uid, libc::gid_t::MAX) }).map(|_| ())
+ }
}
impl AsFd for PtyFollower {
@@ -163,6 +176,7 @@ mod tests {
use std::fs::File;
use std::io::{Read, Write};
use std::os::fd::{AsFd, AsRawFd, FromRawFd};
+ use std::os::unix::ffi::OsStrExt;
#[test]
fn test_pty_open_basic() {
@@ -175,6 +189,33 @@ mod tests {
assert!(terminal::safe_isatty(&pty.follower));
}
+ #[test]
+ fn test_pty_set_owner() {
+ use std::os::unix::fs::MetadataExt;
+
+ let pty = Pty::open().expect("Failed to open PTY");
+ let path = std::ffi::OsStr::from_bytes(pty.path.as_bytes());
+ let before = std::fs::metadata(path).expect("the pty has a path");
+ // the owner it already has needs no privilege
+ pty.follower
+ .set_owner(before.uid())
+ .expect("the owner of the pty may give it to itself");
+ let after = std::fs::metadata(path).expect("the pty has a path");
+ assert_eq!(
+ (after.uid(), after.gid(), after.mode()),
+ (before.uid(), before.gid(), before.mode()),
+ "the group and the mode are kept"
+ );
+ // SAFETY: geteuid does not access memory
+ if unsafe { libc::geteuid() } != 0 {
+ let err = pty
+ .follower
+ .set_owner(before.uid() + 1)
+ .expect_err("another owner needs CAP_CHOWN");
+ assert_eq!(err.raw_os_error(), Some(libc::EPERM));
+ }
+ }
+
#[test]
fn test_pty_follower_clone() {
let pty = Pty::open().expect("Failed to open PTY");
diff --git a/exec/src/runner.rs b/exec/src/runner.rs
index 9273f5d1..a8aa1b7e 100644
--- a/exec/src/runner.rs
+++ b/exec/src/runner.rs
@@ -13,7 +13,7 @@ use crate::orchestrator::{Orchestrator, PreExecContext};
use super::event::{EventRegistry, PollEvent, Process, StopReason};
use super::pipe::{IoLogger, Pipe, io_logger_sealed};
use super::pty::{Pty, PtyLeader};
-use super::signal::{SignalStream, register_signal_handler};
+use super::signal::{SignalStream, register_signal_handler, terminate_process};
use super::terminal::{ProcessId, TermSize, TerminalExt, UserTerm};
pub struct SimpleFileLogger {
@@ -188,6 +188,19 @@ impl ExecRunner {
debug!("runner: command pid set to {pid}");
self.command_pid = pid;
}
+ Ok(ParentMessage::CommandStopped(signal)) => {
+ debug!("runner: command stopped by signal {signal}, suspending");
+ if let Some(foreground) = self.suspend(signal, registry)
+ && self
+ .backchannel
+ .send_monitor_message(&MonitorMessage::Resume { foreground })
+ .is_err()
+ {
+ warn!("runner: failed to resume the command, checking monitor exit");
+ self.check_monitor_exit(registry);
+ }
+ self.pipe.resume_events(registry);
+ }
Ok(ParentMessage::ExitStatus(status)) => {
debug!("runner: exit status received: {status}");
registry.set_exit(std::process::ExitStatus::from_raw(status));
@@ -232,6 +245,100 @@ impl ExecRunner {
Ok(())
}
+ /// Suspend dosr with the stopped command, like a shell job, and tell how to resume the
+ /// command once dosr is continued: `Some(true)` with the pty in its foreground, `Some(false)`
+ /// in the background, `None` to leave it stopped.
+ fn suspend(&mut self, signal: libc::c_int, registry: &mut EventRegistry) -> Option {
+ // A SIGCONT received while suspending would resume the terminal a second time.
+ let _ignore_sigcont = SignalDisposition::set(libc::SIGCONT, libc::SIG_IGN)
+ .inspect_err(|e| warn!("runner: cannot ignore SIGCONT: {e}"))
+ .ok();
+
+ if matches!(signal, libc::SIGTTOU | libc::SIGTTIN) {
+ // The command wants the terminal: when dosr is in the foreground, the command is
+ // resumed at once, whether the terminal was already raw or not (sudo-rs #1598).
+ if !self.foreground && self.check_foreground().is_err() {
+ // the user's terminal was revoked
+ return None;
+ }
+ if self.foreground {
+ if !self.term_raw
+ && self
+ .pipe
+ .left_mut()
+ .set_raw_mode(true, self.preserve_oflag)
+ .is_ok()
+ {
+ self.term_raw = true;
+ }
+ self.pipe.enable_input(registry);
+ return Some(true);
+ }
+ }
+
+ self.pipe.ignore_events(registry);
+ if self.term_raw {
+ match self.pipe.left_mut().restore(false) {
+ Ok(()) => self.term_raw = false,
+ Err(e) => warn!("runner: cannot restore the terminal settings: {e}"),
+ }
+ }
+
+ // Stop the job of dosr with the same signal, with its default action.
+ let default_action = if signal == libc::SIGSTOP {
+ None
+ } else {
+ SignalDisposition::set(signal, libc::SIG_DFL)
+ .inspect_err(|e| warn!("runner: cannot set the default action of {signal}: {e}"))
+ .ok()
+ };
+ let pgrp = self.parent_pgrp.inner();
+ // SAFETY: getpid, kill and killpg do not access memory
+ let suspended = unsafe {
+ (pgrp == libc::getpid() || libc::kill(pgrp, 0) == 0) && libc::killpg(pgrp, signal) == 0
+ };
+ drop(default_action);
+
+ if !suspended {
+ error!("runner: no process group to suspend, terminating the command");
+ terminate_process(self.command_pid, true);
+ return None;
+ }
+ // dosr was continued
+ if self.command_pid <= 0 || self.resume_after_suspend().is_err() {
+ return None;
+ }
+ Some(self.term_raw)
+ }
+
+ /// Set the terminals up again when dosr is continued after a suspension.
+ fn resume_after_suspend(&mut self) -> io::Result<()> {
+ self.check_foreground()?;
+ // the user may have changed the terminal settings while dosr was stopped
+ self.pipe.left().copy_to(self.pipe.right())?;
+ if self.foreground {
+ if self
+ .pipe
+ .left_mut()
+ .set_raw_mode(true, self.preserve_oflag)
+ .is_ok()
+ {
+ self.term_raw = true;
+ }
+ } else {
+ // in the background, dosr cannot use the terminal
+ self.term_raw = false;
+ }
+ Ok(())
+ }
+
+ /// Check whether dosr is in the foreground of the user's terminal.
+ fn check_foreground(&mut self) -> io::Result<()> {
+ let pgrp = self.pipe.left().as_tty()?.tcgetpgrp()?;
+ self.foreground = pgrp == self.parent_pgrp;
+ Ok(())
+ }
+
fn resume_terminal(&mut self) -> io::Result<()> {
if self.term_raw && self.foreground {
debug!(
@@ -349,10 +456,7 @@ pub fn run_no_pty(
return Ok(status);
}
}
- libc::SIGALRM => {
- // SAFETY: kill does not access memory, it only sends a signal to the command
- unsafe { libc::kill(child_pid, libc::SIGKILL) };
- }
+ libc::SIGALRM => terminate_process(child_pid, false),
libc::SIGWINCH => {
// SAFETY: kill does not access memory, it only sends a signal to the command
unsafe { libc::kill(child_pid, libc::SIGWINCH) };
@@ -387,9 +491,23 @@ pub fn run(
command: Command,
orchestrator: Orchestrator,
logger: Option>,
+) -> io::Result {
+ run_with_pty_setup(command, orchestrator, logger, |_| Ok(()))
+}
+
+/// Like [`run`], and when the command gets a pty, `pty_setup` prepares it before the command
+/// starts, for example to give it to the user that the command runs as.
+///
+/// # Errors
+/// Returns the errors of [`run`], and the error of `pty_setup`, before the command starts.
+pub fn run_with_pty_setup(
+ command: Command,
+ orchestrator: Orchestrator,
+ logger: Option>,
+ pty_setup: impl FnOnce(&Pty) -> io::Result<()>,
) -> io::Result {
match UserTerm::open() {
- Ok(term) => run_with_pty(command, orchestrator, logger, term),
+ Ok(term) => run_in_pty(command, orchestrator, logger, term, pty_setup),
Err(_) => run_no_pty(command, orchestrator),
}
}
@@ -416,12 +534,22 @@ pub fn run(
/// - Failure in the backchannel communication
/// - Failure in the orchestrator's pre-exec function
/// - Failure in spawning the command execution
-#[allow(clippy::too_many_lines)]
pub fn run_with_pty(
+ command: Command,
+ orchestrator: Orchestrator,
+ logger: Option>,
+ user_term: UserTerm,
+) -> io::Result {
+ run_in_pty(command, orchestrator, logger, user_term, |_| Ok(()))
+}
+
+#[allow(clippy::too_many_lines)]
+fn run_in_pty(
command: Command,
orchestrator: Orchestrator,
logger: Option>,
mut user_term: UserTerm,
+ pty_setup: impl FnOnce(&Pty) -> io::Result<()>,
) -> io::Result {
let original_set = block_all_signals();
@@ -444,6 +572,11 @@ pub fn run_with_pty(
// Create Pty
let pty = Pty::open()?;
+ if let Err(e) = pty_setup(&pty) {
+ // the caller goes on without the command: its signals are delivered again
+ restore_signals(original_set);
+ return Err(e);
+ }
let tty_size = user_term.get_size().unwrap_or_else(|_| TermSize::new(0, 0));
pty.leader.set_size(&tty_size)?; // set window size by default, resizing comes with features
debug!("runner(pty): initial tty size {tty_size}");
@@ -645,6 +778,42 @@ pub fn run_with_pty(
}
}
+/// Changes the action of a signal until it is dropped, then puts the previous action back.
+struct SignalDisposition {
+ signal: libc::c_int,
+ previous: libc::sigaction,
+}
+
+impl SignalDisposition {
+ fn set(signal: libc::c_int, action: libc::sighandler_t) -> io::Result {
+ // SAFETY: sigaction is a plain C struct, for which all zeroes is a valid value
+ let mut new: libc::sigaction = unsafe { std::mem::zeroed() };
+ new.sa_sigaction = action;
+ // SAFETY: sigaction is a plain C struct, for which all zeroes is a valid value
+ let mut previous: libc::sigaction = unsafe { std::mem::zeroed() };
+ // SAFETY: both pointers reference valid sigaction structs that outlive the call
+ if unsafe { libc::sigaction(signal, &raw const new, &raw mut previous) } == -1 {
+ return Err(io::Error::last_os_error());
+ }
+ Ok(Self { signal, previous })
+ }
+}
+
+impl Drop for SignalDisposition {
+ fn drop(&mut self) {
+ // SAFETY: `previous` was filled by sigaction for this signal, and outlives the call
+ if unsafe { libc::sigaction(self.signal, &raw const self.previous, std::ptr::null_mut()) }
+ == -1
+ {
+ warn!(
+ "runner: cannot restore the action of signal {}: {}",
+ self.signal,
+ io::Error::last_os_error()
+ );
+ }
+ }
+}
+
fn block_all_signals() -> Option {
// SAFETY: sigset_t is a plain bitmask, for which all zeroes is a valid value
let mut set = unsafe { std::mem::zeroed::() };
@@ -672,7 +841,7 @@ fn restore_signals(original: Option) {
#[allow(clippy::undocumented_unsafe_blocks)]
#[cfg(test)]
mod tests {
- use super::{SimpleFileLogger, run_no_pty};
+ use super::{SimpleFileLogger, run_no_pty, run_with_pty_setup};
use crate::MUTEX;
use crate::orchestrator::{Orchestrator, PreExecContext, PreExecStep, Stage};
use crate::pipe::io_logger_sealed::Sealed;
@@ -791,6 +960,29 @@ mod tests {
let _ = fs::remove_file(path);
}
+ // suspending dosr sets SIGCONT to ignored and the stop signal to its default action, and must
+ // put the previous actions back once dosr is continued
+ #[test]
+ fn signal_disposition_restores_the_previous_action() {
+ fn action(signal: libc::c_int) -> libc::sighandler_t {
+ let mut current: libc::sigaction = unsafe { std::mem::zeroed() };
+ assert_eq!(
+ unsafe { libc::sigaction(signal, std::ptr::null(), &raw mut current) },
+ 0
+ );
+ current.sa_sigaction
+ }
+
+ let _guard = MUTEX.lock().unwrap();
+ let before = action(libc::SIGUSR2);
+ {
+ let _ignored = super::SignalDisposition::set(libc::SIGUSR2, libc::SIG_IGN)
+ .expect("ignore SIGUSR2");
+ assert_eq!(action(libc::SIGUSR2), libc::SIG_IGN);
+ }
+ assert_eq!(action(libc::SIGUSR2), before);
+ }
+
#[test]
fn run_no_pty_returns_command_exit_code() {
let _guard = MUTEX.lock().unwrap();
@@ -813,6 +1005,51 @@ mod tests {
assert!(status.success());
}
+ /// Whether this thread blocks each of the standard signals.
+ fn signal_mask() -> Vec {
+ let mut set: libc::sigset_t = unsafe { std::mem::zeroed() };
+ assert_eq!(
+ unsafe { libc::pthread_sigmask(libc::SIG_BLOCK, std::ptr::null(), &raw mut set) },
+ 0
+ );
+ (1..libc::SIGRTMIN())
+ .map(|signal| unsafe { libc::sigismember(&raw const set, signal) } == 1)
+ .collect()
+ }
+
+ // with a terminal, a failed setup of the pty stops before the command starts; without one,
+ // there is no pty to set up and the command runs
+ #[test]
+ fn run_with_pty_setup_stops_on_a_failed_setup() {
+ let _guard = MUTEX.lock().unwrap();
+ let dir = std::env::temp_dir().join(format!("rar-pty-setup-{}", std::process::id()));
+ std::fs::create_dir_all(&dir).expect("create the test directory");
+ let marker = dir.join("ran");
+ let mut command = Command::new("/usr/bin/touch");
+ command.arg(&marker);
+ let mask_before = signal_mask();
+ let mut called = false;
+ let result = run_with_pty_setup(command, Orchestrator::new(NOOP_STEPS), None, |pty| {
+ called = true;
+ assert!(!pty.path.as_bytes().is_empty());
+ Err(io::Error::other("setup refused"))
+ });
+ if called {
+ let error = result.expect_err("the setup error is returned");
+ assert_eq!(error.to_string(), "setup refused");
+ assert!(!marker.exists(), "the command did not start");
+ assert_eq!(
+ signal_mask(),
+ mask_before,
+ "the signals are delivered again"
+ );
+ } else {
+ assert!(result.expect("run without a pty").success());
+ assert!(marker.exists(), "the command ran without a pty");
+ }
+ let _ = std::fs::remove_dir_all(&dir);
+ }
+
#[test]
fn run_no_pty_propagates_pre_exec_failure() {
let _guard = MUTEX.lock().unwrap();
diff --git a/exec/src/signal.rs b/exec/src/signal.rs
index 9c582ae7..bf03dd34 100644
--- a/exec/src/signal.rs
+++ b/exec/src/signal.rs
@@ -229,6 +229,35 @@ pub fn register_signal_handler(signal: SignalNumber) -> io::Result<()> {
Ok(())
}
+/// How long a command is given to end after `SIGHUP` and `SIGTERM`, before `SIGKILL`, like sudo.
+pub const TERMINATION_DELAY: std::time::Duration = std::time::Duration::from_secs(2);
+
+/// Stop a command with increasing urgency, like sudo's `terminate_command`.
+///
+/// `SIGHUP`, `SIGTERM`, then `SIGKILL` once [`TERMINATION_DELAY`] has passed, so that the command
+/// can clean up first. With `process_group`, the signals go to the process group `pid` instead of
+/// the process.
+pub fn terminate_process(pid: libc::pid_t, process_group: bool) {
+ // kill(0) and killpg(0) would signal dosr's own group, kill(-1) every process it may signal
+ if pid <= 0 {
+ return;
+ }
+ let send = |signal| {
+ // SAFETY: kill and killpg do not access memory, they only send a signal
+ unsafe {
+ if process_group {
+ libc::killpg(pid, signal)
+ } else {
+ libc::kill(pid, signal)
+ }
+ };
+ };
+ send(libc::SIGHUP);
+ send(libc::SIGTERM);
+ std::thread::sleep(TERMINATION_DELAY);
+ send(libc::SIGKILL);
+}
+
#[allow(clippy::undocumented_unsafe_blocks)]
#[cfg(test)]
mod tests {
@@ -236,6 +265,59 @@ mod tests {
MUTEX,
signal::{self, SignalStream},
};
+ use std::os::unix::process::{CommandExt, ExitStatusExt};
+ use std::process::Command;
+ use std::time::{Duration, Instant};
+
+ /// A shell in its own process group, given time to set its traps up.
+ fn spawn_shell(script: &str) -> (std::process::Child, libc::pid_t) {
+ let child = Command::new("sh")
+ .arg("-c")
+ .arg(script)
+ .process_group(0)
+ .spawn()
+ .expect("spawn the shell");
+ std::thread::sleep(Duration::from_millis(300));
+ let pid = libc::pid_t::try_from(child.id()).expect("pid in range");
+ (child, pid)
+ }
+
+ // A command that handles SIGHUP or SIGTERM cleans up and ends before SIGKILL.
+ #[test]
+ fn terminate_process_lets_the_command_clean_up() {
+ let _guard = MUTEX.lock().unwrap();
+ let marker =
+ std::env::temp_dir().join(format!("rar-terminate-cleanup-{}", std::process::id()));
+ let _ = std::fs::remove_file(&marker);
+ let (mut child, pid) = spawn_shell(&format!(
+ "trap 'echo done > {}; exit 3' HUP TERM; while :; do sleep 0.1; done",
+ marker.display()
+ ));
+
+ signal::terminate_process(pid, true);
+ let status = child.wait().expect("wait for the shell");
+ let cleaned = marker.exists();
+ let _ = std::fs::remove_file(&marker);
+ assert_eq!(
+ status.code(),
+ Some(3),
+ "the shell ended on its own: {status:?}"
+ );
+ assert!(cleaned, "the shell cleaned up");
+ }
+
+ // A command that ignores SIGHUP and SIGTERM is killed once the delay has passed.
+ #[test]
+ fn terminate_process_kills_a_command_that_ignores_the_signals() {
+ let _guard = MUTEX.lock().unwrap();
+ let (mut child, pid) = spawn_shell("trap '' HUP TERM; while :; do sleep 0.1; done");
+
+ let start = Instant::now();
+ signal::terminate_process(pid, true);
+ let status = child.wait().expect("wait for the shell");
+ assert_eq!(status.signal(), Some(libc::SIGKILL));
+ assert!(start.elapsed() >= signal::TERMINATION_DELAY);
+ }
#[test]
fn test_signals_combined() {
diff --git a/exec/src/terminal.rs b/exec/src/terminal.rs
index 186b710a..c5dd6b4a 100644
--- a/exec/src/terminal.rs
+++ b/exec/src/terminal.rs
@@ -561,4 +561,15 @@ mod tests {
.expect("ttyname should work on pty follower");
assert_eq!(ttyname.as_os_str().as_bytes(), pty.path.as_bytes());
}
+
+ // A stdio terminal that is not the controlling terminal of dosr is not the user's terminal:
+ // it is given to the command as it is, never proxied through the pty nor set to raw mode.
+ #[test]
+ fn test_a_terminal_that_is_not_ours_is_not_the_user_terminal() {
+ let pty = Pty::open().expect("Failed to open PTY");
+ assert!(terminal::safe_isatty(&pty.follower));
+ // SAFETY: getpgrp does not access memory
+ let pgrp = ProcessId::new(unsafe { libc::getpgrp() });
+ assert!(!pty.follower.is_terminal_for_pgrp(pgrp));
+ }
}
diff --git a/resources/arch/PKGBUILD b/resources/arch/PKGBUILD
deleted file mode 100644
index 78772780..00000000
--- a/resources/arch/PKGBUILD
+++ /dev/null
@@ -1,62 +0,0 @@
-# Maintainer: Eddie Billoir
-
-pkgname=rootasrole
-pkgver=4.1.0
-pkgrel=1
-pkgdesc='Alternative to sudo to run some administrative commands that uses Linux capabilities and RBAC for scalability.'
-url='https://lechatp.github.io/RootAsRole/'
-license=('LGPL-3.0-or-later')
-arch=('x86_64')
-depends=('libcap' 'e2fsprogs' 'pam')
-makedepends=('cargo')
-backup=('etc/pam.d/dosr')
-validpgpkeys=('74F43C5774BE1F3527DEFA4835C155EA0525104D')
-source=("$pkgname-$pkgver.tar.gz::https://static.crates.io/crates/$pkgname/$pkgname-$pkgver.crate")
-sha256sums=('SKIP')
-install=rootasrole.install
-
-prepare() {
- cd "$pkgname-$pkgver"
- export RUSTUP_TOOLCHAIN=stable
- cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
-}
-
-build() {
- cd "$pkgname-$pkgver"
- export RUSTUP_TOOLCHAIN=stable
- export CARGO_TARGET_DIR=target
- cargo build --frozen --release --all-features
-}
-
-check() {
- cd "$pkgname-$pkgver"
- export RUSTUP_TOOLCHAIN=stable
- export CARGO_TARGET_DIR=target
- cargo test --frozen --all-features
-}
-
-package() {
- cd "$pkgname-$pkgver"
- install -Dm755 'target/release/dosr' -t "$pkgdir/usr/bin"
- install -Dm755 'target/release/chsr' -t "$pkgdir/usr/bin"
- install -Dm644 'resources/arch/arch_sr_pam.conf' "$pkgdir/etc/pam.d/dosr"
- # the root file and the default policy, installed by rootasrole.install,
- # which also sets the administrator of the default policy
- install -dm755 "$pkgdir/usr/share/rootasrole"
- sed "s/PACKAGE_VERSION/$pkgver/" 'resources/rootasrole.json' \
- > "$pkgdir/usr/share/rootasrole/default.json"
- cat > "$pkgdir/usr/share/rootasrole/rootasrole.json" < "$POLICY_FILE"
- chmod 600 "$POLICY_FILE"
- log "The default policy lets $admin run every command with dosr, and edit the policy with chsr."
-
- # dosr refuses a policy file without the immutable flag when the policy is immutable
- FS_TYPE=$(df -T "$POLICY_DIR" | awk 'NR==2 {print $2}')
- case "$FS_TYPE" in
- ext2 | ext3 | ext4 | xfs | btrfs | ocfs2 | jfs | reiserfs)
- if chattr +i "$ROOT_FILE" "$POLICY_FILE" && chattr +i "$POLICY_DIR"; then
- return 0
- fi
- log "Failed to set the immutable flag on the policy"
- chattr -i "$POLICY_DIR" "$POLICY_FILE" "$ROOT_FILE" 2>/dev/null
- ;;
- *)
- log "The file system $FS_TYPE does not support the immutable flag."
- ;;
- esac
- # without the flag, the policy is not declared immutable and no task needs to change it
- sed -i 's/"immutable": true/"immutable": false/' "$ROOT_FILE"
- sed -i 's;"CAP_LINUX_IMMUTABLE";;g' "$POLICY_FILE"
-}
-
-post_upgrade() {
- set_capabilities
- if [ -f "$ROOT_FILE" ] && ! chsr upgrade; then
- log "Some policy files could not be upgraded, check them with 'chsr upgrade --check'"
- fi
-}
diff --git a/resources/man/en_US.md b/resources/man/en_US.md
index f4362237..be938aa2 100644
--- a/resources/man/en_US.md
+++ b/resources/man/en_US.md
@@ -7,6 +7,7 @@ RootAsRole - An alternative to sudo/su commands that adheres to the principle of
# SYNOPSIS
- **dosr** [__OPTIONS__] [__COMMAND__]...
+- **dosr** [__OPTIONS__] -- [__COMMAND__]...
- **chsr** [__ARGUMENTS__]
**chsr**'s arguments follow a grammar available at
@@ -28,10 +29,12 @@ The **chsr** command is used to configure RootAsRole and its access control poli
The storage mode of the access control policy can be configured. By default, RootAsRole uses a JSON file. It is possible to change the storage mode by manually modifying the **/etc/security/rootasrole.json** file.
-Regarding authentication, RootAsRole uses Pluggable Authentication Module (PAM). The **/etc/pam.d/dosr** file can be configured to change authentication behavior.
+Regarding authentication, RootAsRole uses Pluggable Authentication Module (PAM). The **/etc/pam.d/dosr** file can be configured to change authentication behavior. Also it is possible to configure the number of password attempts and the delay between them in the RootAsRole policy.
The core of RootAsRole implements RBAC-0, a simplified version of RBAC. By default, it adds features in the form of plugins to implement certain RBAC-1 functionalities. RBAC-0 simply implements roles, tasks, and permissions. Plugins add role hierarchy and separation of duties. Plugins can only be implemented directly in the project. Another plugin allows testing the checksum of executed files.
+Finally, for observing the usage of RaR tool on your system, you can use the `journalctl -t dosr` command to view the logs of the `dosr` service. This will provide information about the execution of commands and any errors that may have occurred.
+
# OPTIONS
**\-r, --role** <ROLE>
@@ -84,7 +87,7 @@ You can find the history of RootAsRole on the website to determine the required capabilities for a command. However, this tool might give too many capabilities. It is recommended to verify if the capabilities are truly necessary, as in most cases, they are not. It is discouraged to use "capable" in production, as it is only for testing purposes.
diff --git a/resources/man/fr_FR.md b/resources/man/fr_FR.md
index ce6b3d57..0690c028 100644
--- a/resources/man/fr_FR.md
+++ b/resources/man/fr_FR.md
@@ -7,6 +7,7 @@ RootAsRole - Une alternative pour les commandes sudo/su respectant le principe d
# SYNOPSIS
- **dosr** [__OPTIONS__] [__COMMAND__]...
+- **dosr** [__OPTIONS__] -- [__COMMAND__]...
- **chsr** [__ARGUMENTS__]
Les arguments suivent une grammaire disponible dans le code source à l'adresse
@@ -27,10 +28,12 @@ La commande **chsr** sert à configurer RootAsRole et sa politique de contrôle
Il est possible de configurer le mode de stockage de la politique de contrôle d'accès. Par défaut, RootAsRole utilise un fichier JSON. Il est possible de changer le mode de stockage en modifiant manuellement le fichier **/etc/security/rootasrole.json**.
-Concernant l'authentification, RootAsRole utilise PAM. Il est possible de configurer le fichier **/etc/pam.d/dosr** pour changer le comportement de l'authentification.
+Concernant l'authentification, RootAsRole utilise PAM. Il est possible de configurer le fichier **/etc/pam.d/dosr** pour changer le comportement de l'authentification. Il est également possible de configurer le nombre de tentatives de mot de passe et le délai entre elles dans la politique de RootAsRole.
Le coeur de RootAsRole implémente RBAC-0, une version simplifiée de RBAC. Par défaut il ajoute des fonctionnalités sous forme de plugins pour implémenter certaines fonctionnalités de RBAC-1. RBAC-0 implémente simplement les rôles, les tâches et les permissions. Les plugins ajoutent la hiérarchie de rôles et séparation des devoirs. Les plugins sont uniquement implémentable directement dans le projet. Il y a également un autre plugin qui permet de tester la somme de contrôle des fichiers exécutés.
+Enfin, pour observer l'utilisation de l'outil RaR sur votre système, vous pouvez utiliser la commande `journalctl -t dosr` pour voir les logs du service `dosr`. Cela vous donnera des informations sur l'exécution des commandes et les éventuelles erreurs qui ont pu se produire.
+
# OPTIONS
**\-r, --role** <ROLE>
@@ -83,7 +86,7 @@ Vous pouvez trouver l'historique de RootAsRole sur le site web pour déterminer les capabilities nécessaires pour une commande. Cependant, il est également possible que cette commande donne trop de capabilities. Il est donc recommandé de vérifier si les capabilities sont bien nécessaires car dans la plupart des cas, les capabilities ne sont pas nécessaires. Il est fortement déconseillé d'utiliser cet outil en production.
diff --git a/resources/opensuse/opensuse.conf b/resources/opensuse/opensuse.conf
index b5ebcb11..bc1e317f 100644
--- a/resources/opensuse/opensuse.conf
+++ b/resources/opensuse/opensuse.conf
@@ -3,4 +3,4 @@ auth include common-auth
account include common-account
password include common-password
session optional pam_keyinit.so revoke
-session include common-session-nonlogin
\ No newline at end of file
+session include common-session-nonlogin
diff --git a/resources/rh/postinst.sh b/resources/rh/postinst.sh
deleted file mode 100644
index 1267b1ed..00000000
--- a/resources/rh/postinst.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-if [ -z ${SUDO_USER+x} ]; then INSTALL_USER=$(id -urn); else INSTALL_USER=$SUDO_USER; fi
-
-filesystem() {
- df -T "$1" | awk 'NR==2 {print $2}'
-}
-
-configure() {
- echo "Configuring rootasrole.json"
- sed -i "s/ROOTADMINISTRATOR/$INSTALL_USER/g" /etc/security/rootasrole.json
- FS=$(filesystem /etc/security/rootasrole.json)
- case $FS in
- "ext2" | "ext3" | "ext4" | "xfs" | "btrfs" | "ocfs2" | "jfs" | "reiserfs")
- echo "Setting immutable attribute on /etc/security/rootasrole.json"
- chattr +i /etc/security/rootasrole.json
- ;;
- *)
- echo "filesystem $FS does not support immutable attribute"
- echo "Removing immutable parameter from /etc/security/rootasrole.json"
- sed -i "s/\"immutable\": true/\"immutable\": false/g" /etc/security/rootasrole.json
- sed -i "s;\"CAP_LINUX_IMMUTABLE\";;g" /etc/security/rootasrole.json
- ;;
- esac
-}
-
-if [ -f /etc/security/rootasrole.json ]; then
- if grep -q "ROOTADMINISTRATOR" /etc/security/rootasrole.json; then
- configure
- elif ! chsr upgrade; then
- echo "Some policy files could not be upgraded, check them with 'chsr upgrade --check'"
- fi
-fi
diff --git a/resources/rh/prerm.sh b/resources/rh/prerm.sh
deleted file mode 100644
index c0a05adb..00000000
--- a/resources/rh/prerm.sh
+++ /dev/null
@@ -1 +0,0 @@
-chattr -i /etc/security/rootasrole.json 2>/dev/null || true
\ No newline at end of file
diff --git a/resources/rh/rh_sr_pam.conf b/resources/rh/rh_sr_pam.conf
index 1f03d24b..fcb7a466 100644
--- a/resources/rh/rh_sr_pam.conf
+++ b/resources/rh/rh_sr_pam.conf
@@ -2,4 +2,4 @@
auth include system-auth
account include system-auth
password include system-auth
-session include system-auth
\ No newline at end of file
+session include system-auth
diff --git a/src/chsr/cli/cli.pest b/src/chsr/cli/cli.pest
index 10af03b3..946fced2 100644
--- a/src/chsr/cli/cli.pest
+++ b/src/chsr/cli/cli.pest
@@ -72,12 +72,20 @@ policy_path = @{ name }
role = { ("role" | "r") ~ roles_operations }
roles_operations = { purge | role_operations }
-role_operations = { role_id ~ ( add | del | role_show_purge | role_grant_revoke | tasks_operations | options_operations) }
+role_operations = { role_id ~ ( add | del | role_show_purge | role_grant_revoke | role_links | tasks_operations | options_operations) }
role_id = @{ name }
role_grant_revoke = { (grant | revoke) ~ user_or_groups }
role_show_purge = { (list|purge) ~ role_type_arg? }
role_type_arg = @{ "actors" | "tasks" | all }
+// chsr r r1 ssd add r2,r3 the roles that a member of r1 must not hold (ssd plugin)
+// chsr r r1 parents set r2 the roles whose tasks r1 gets (hierarchy plugin)
+// chsr r r1 ssd purge
+role_links = { role_link_kind ~ ((add | del | set) ~ linked_roles | purge) }
+role_link_kind = { "ssd" | "parents" }
+linked_roles = { linked_role ~ ("," ~ linked_role)* }
+linked_role = @{ (!("," | WHITESPACE) ~ ANY)+ }
+
user_or_groups = { (user | group)+ }
user = ${ ("--user" ~ assignment | "-u" ~ WHITESPACE+) ~ actor_name }
@@ -95,7 +103,13 @@ actor_name = @{ (CASED_LETTER | "_") ~ ((CASED_LETTER | ASCII_DIGIT
// chsr r r1 t t1 del
tasks_operations = { task_spec ~ (task_operations | options_operations) }
-task_operations = { task_show_purge | add | del | command_operations | credentials_operations }
+task_operations = { task_show_purge | add | del | command_operations | credentials_operations | purpose_operations }
+
+// chsr r r1 t t1 purpose set Back up the databases
+// chsr r r1 t t1 purpose unset
+purpose_operations = _{ purpose_keyword ~ (set ~ purpose_text | del) }
+purpose_keyword = { "purpose" }
+purpose_text = ${ ANY+ }
task_show_purge = { (list | purge) ~ task_type_arg? }
task_type_arg = { all | cmd_keyword | cred_keyword }
@@ -116,8 +130,15 @@ command_operations = _{ cmd_keyword ~ (cmd_setpolicy | cmd_checklisting) }
cmd_setpolicy = { setpolicy ~ cmd_policy }
cmd_policy = { "allow-all" | "deny-all" }
-cmd_checklisting = { (whitelist | blacklist) ~ ((add | del) ~ cmd | purge) }
-cmd = ${ ANY+ }
+cmd_checklisting = { (whitelist | blacklist) ~ ((add | del) ~ cmd_checks? ~ cmd | purge) }
+// chsr r r1 t t1 cmd whitelist add --sha256 --read-only /usr/bin/ls (hashchecker plugin)
+cmd_checks = { (cmd_hash | cmd_check_flag)+ }
+cmd_hash = ${ cmd_hash_type ~ ("=" | WHITESPACE+) ~ cmd_hash_value }
+cmd_hash_type = { "--sha224" | "--sha256" | "--sha384" | "--sha512" }
+cmd_hash_value = @{ (!WHITESPACE ~ ANY)+ }
+cmd_check_flag = { "--read-only" | "--immutable" }
+// a command never starts with a check: a malformed check is an error, not part of the command
+cmd = ${ !("--sha" | "--read-only" | "--immutable") ~ ANY+ }
// ========================
// credentials
@@ -130,12 +151,15 @@ cred_keyword = { ("credentials" | "cred") }
credentials_operations = _{ cred_keyword ~ (cred_set_operations | cred_caps_operations | list) }
cred_set_operations = _{ (set | del) ~ cred_set_args }
cred_set_args = _{
- (cred_c | cred_u | cred_g)+
+ (cred_c | cred_u | cred_from | cred_g)+
| help
}
cred_c = ${ ("--caps" ~ assignment | "-c" ~ WHITESPACE+) ~ capabilities? }
cred_u = ${ ("--setuid" ~ assignment | "-u" ~ WHITESPACE+) ~ actor_name }
cred_g = ${ ("--setgid" ~ assignment | "-g" ~ WHITESPACE+) ~ name_combination }
+// before cred_g, which --setgid-from starts like
+cred_from = ${ "--setgid-from" ~ ("=" | WHITESPACE+) ~ groups_from }
+groups_from = { "caller" | "target" }
capabilities = _{ capability ~ (","?) ~ capabilities | capability }
capability = @{ ^"CAP_"? ~ (LETTER | "_")+ }
@@ -168,11 +192,17 @@ caps_listing = { (whitelist | blacklist) ~ ((add | del | set) ~ capabilities
// chsr o timeout set --type tty --duration 5:00 --max_usage 1
// chsr o t unset --type --duration --max_usage
+// chsr o password set --tries 3 --delay 00:00:05
+// chsr o password unset --tries --delay
+
+// chsr o tty owner (target|caller|unset)
+
options_operations = { ("options" | "o") ~ opt_args }
-opt_args = _{ opt_show | opt_path | opt_workdir | opt_env | opt_root | opt_bounding | opt_timeout | opt_skip_auth | opt_execinfo | opt_mask }
+opt_args = _{ opt_show | opt_path | opt_workdir | opt_env | opt_root | opt_bounding | opt_timeout | opt_password | opt_tty | opt_skip_auth | opt_execinfo | opt_mask }
opt_show = _{ list ~ opt_show_arg? }
-opt_show_arg = { "all" | "cmd" | "cred" | "path" | "env" | "root" | "bounding" | "timeout" }
+// a longer name before its prefix: "authentication" before "auth"
+opt_show_arg = { "all" | "path" | "env" | "root" | "bounding" | "timeout" | "password" | "tty" | "authentication" | "auth" | "execinfo" | "info" | "umask" | "mask" | "workdir" }
opt_path = { "path" ~ (opt_path_args | help) }
opt_path_args = _{ opt_path_setpolicy | opt_path_set | opt_path_listing }
@@ -188,7 +218,10 @@ opt_workdir_listing = { (whitelist | blacklist) ~ (((add | del | set) ~ path)
workdir_policy = { "all" | "none" | "inherit" }
opt_env = { "env" ~ (opt_env_args | help) }
-opt_env_args = _{ opt_env_setpolicy | opt_env_keep | opt_env_delete | opt_env_set | opt_env_listing | opt_env_setlisting }
+opt_env_args = _{ opt_env_override | opt_env_setpolicy | opt_env_keep | opt_env_delete | opt_env_set | opt_env_listing | opt_env_setlisting }
+// chsr o env override allow|deny|unset whether dosr -E may change the env behavior
+opt_env_override = { "override" ~ (env_override_value | del) }
+env_override_value = { "allow" | "deny" }
opt_env_setpolicy = { setpolicy ~ env_policy }
env_policy = { "delete-all" | "keep-all" | "inherit" }
opt_env_listing = { (whitelist | blacklist | checklist) ~ (((add | del | set) ~ env_key_list) | purge) }
@@ -207,7 +240,8 @@ env_unquoted_value = { (!"," ~ !"\"" ~ ANY)* }
env_char = _{ (!"\\" ~ !"\"") ~ ANY }
env_escape = _{ "\\" ~ ("\"" | ",") }
-env_key = @{ (CASED_LETTER | "_") ~ (CASED_LETTER | ASCII_DIGIT | "-" | "_")+ }
+// a variable name, where `*` matches any characters (core::util::is_valid_env_pattern)
+env_key = @{ (ASCII_ALPHA | "_" | "*") ~ (ASCII_ALPHANUMERIC | "_" | "*")* }
opt_root = { "root" ~ (opt_root_args | help) }
opt_root_args = { del | "privileged" | "user" }
@@ -221,6 +255,10 @@ opt_skip_auth_args = { del | "skip" | "perform" }
opt_execinfo = { ( "execinfo" | "info") ~ (opt_execinfo_args | help) }
opt_execinfo_args = { del | "show" | "hide" }
+opt_tty = { "tty" ~ (opt_tty_owner | help) }
+opt_tty_owner = { "owner" ~ opt_tty_owner_args }
+opt_tty_owner_args = { del | "target" | "caller" }
+
opt_mask = { ( "umask" | "mask") ~ (opt_mask_args | help) }
opt_mask_args = { ASCII_DIGIT{1,4} | del }
@@ -243,6 +281,13 @@ seconds = _{ ASCII_DIGIT+ }
opt_timeout_m_arg = { ("--max-usage" ~ assignment | "-m" ) ~ opt_timeout_max_usage? }
opt_timeout_max_usage = { ASCII_DIGIT+ }
+opt_password = { "password" ~ (opt_password_operations | help) }
+opt_password_operations = { (set | del) ~ opt_password_args }
+opt_password_args = _{ opt_password_t_arg ~ opt_password_d_arg? | opt_password_d_arg ~ opt_password_t_arg? }
+opt_password_t_arg = { ("--tries" ~ assignment | "-t") ~ opt_password_tries? }
+opt_password_tries = @{ ASCII_DIGIT+ }
+opt_password_d_arg = { ("--delay" ~ assignment | "-d") ~ opt_password_delay? }
+opt_password_delay = @{ ASCII_DIGIT+ ~ (":" ~ ASCII_DIGIT+){0,2} }
assignment = _{ "=" | WHITESPACE*}
help = { "-h" | "--help" }
diff --git a/src/chsr/cli/data.rs b/src/chsr/cli/data.rs
index 8f9762f0..6dbc066c 100644
--- a/src/chsr/cli/data.rs
+++ b/src/chsr/cli/data.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, path::PathBuf};
+use std::{collections::HashMap, num::NonZeroU8, path::PathBuf};
use bon::Builder;
use capctl::CapSet;
@@ -11,9 +11,9 @@ use rootasrole_core::{
actor::{SActor, SGroups, SUserType},
options::{
EnvBehavior, EnvKey, OptType, PathBehavior, SAuthentication, SBounding, SInfo,
- SPrivileged, SUMask, TimestampType, WorkdirBehavior,
+ SPrivileged, SUMask, TimestampType, TtyOwner, WorkdirBehavior,
},
- structs::{IdTask, SetBehavior},
+ structs::{GroupsFrom, IdTask, SetBehavior},
},
util::StorageMethod,
};
@@ -58,6 +58,49 @@ pub enum SetListType {
Set,
}
+/// The links of a role to other roles, kept in the role for the plugins.
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+pub enum RoleLink {
+ /// The roles that a member of the role must not hold (ssd plugin)
+ Ssd,
+ /// The roles whose tasks the role gets (hierarchy plugin)
+ Parents,
+}
+
+impl RoleLink {
+ #[must_use]
+ pub const fn key(self) -> &'static str {
+ match self {
+ Self::Ssd => "ssd",
+ Self::Parents => "parents",
+ }
+ }
+}
+
+/// Whether `dosr -E` may change the env behavior, for `chsr o env override`.
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+pub enum EnvOverride {
+ Allow,
+ Deny,
+ Unset,
+}
+
+/// The checks of the hashchecker plugin on the file of a command (deprecated, removed in 5.0).
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub struct CommandChecks {
+ /// The hash type (`sha256`...) and the hash in hexadecimal
+ pub hash: Option<(String, String)>,
+ pub read_only: bool,
+ pub immutable: bool,
+}
+
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+#[repr(usize)]
+pub enum PasswordOpt {
+ Tries = 0,
+ Delay,
+}
+
#[derive(Debug, PartialEq, Eq, Clone, Copy)]
#[repr(usize)]
pub enum TimeoutOpt {
@@ -78,6 +121,15 @@ pub struct Inputs {
pub timeout_type: Option,
pub timeout_duration: Option,
pub timeout_max_usage: Option,
+ pub role_link: Option,
+ pub role_links: Option>,
+ pub purpose: bool,
+ pub task_purpose: Option,
+ pub cmd_checks: CommandChecks,
+ pub options_env_override: Option,
+ pub password_arg: Option<[bool; 2]>,
+ pub password_tries: Option,
+ pub password_delay: Option,
pub policy: bool,
pub policy_path: Option,
pub role_id: Option,
@@ -86,10 +138,13 @@ pub struct Inputs {
pub task_id: Option,
pub task_type: Option,
pub cmd_policy: Option,
- pub cmd_id: Option>,
+ /// The command line to write in the policy, see `policy_command_line`
+ pub cmd_id: Option,
pub cred_caps: Option,
pub cred_setuid: Option,
pub cred_setgid: Option,
+ /// Whose groups the command gets when the task does not force them
+ pub cred_groups_from: Option,
pub cred_policy: Option,
pub options: bool,
pub options_type: Option,
@@ -102,6 +157,7 @@ pub struct Inputs {
pub options_bounding: Option,
pub options_auth: Option,
pub options_execinfo: Option,
+ pub options_tty_owner: Option,
pub options_umask: Option,
pub options_workdir_policy: Option,
pub convertion: Option,
diff --git a/src/chsr/cli/editor.rs b/src/chsr/cli/editor.rs
index 5c1bf376..6adcb767 100644
--- a/src/chsr/cli/editor.rs
+++ b/src/chsr/cli/editor.rs
@@ -176,7 +176,7 @@ where
new_config.warn_anomalies(&mut warn_handler);
debug!("config: {new_config:#?}");
let after = serde_json::to_string_pretty(&new_config)?;
- writeln!(output, "Resulting confguration: {after}")?;
+ writeln!(output, "Resulting configuration: {after}")?;
let after = serde_json::from_str::(&after)?;
debug!("re-serialised: {after:#?}");
// Yes == save, No and edit again == continue loop, abort == return false
@@ -207,7 +207,7 @@ where
Err(e) => {
writeln!(output, "Your modifications are invalid:\n{e}")?;
writeln!(output, "Do you want to continue editing?")?;
- writeln!(output, " [Y]ontinue editing (Recommended)")?;
+ writeln!(output, " [Y]es to continue editing (Recommended)")?;
writeln!(output, " [A]bort to exit without saving")?;
write!(output, "Your choice [Y/a]: ")?;
output.flush()?;
diff --git a/src/chsr/cli/mod.rs b/src/chsr/cli/mod.rs
index 76135b41..93a19a9f 100644
--- a/src/chsr/cli/mod.rs
+++ b/src/chsr/cli/mod.rs
@@ -11,18 +11,42 @@ pub mod usage;
use std::{error::Error, path::PathBuf};
use bon::builder;
-use data::{Cli, Inputs, Rule};
+use data::{Cli, InputAction, Inputs, Rule};
use landlock::RulesetStatus;
-use log::debug;
+use log::{debug, warn};
use pair::recurse_pair;
use pest::Parser;
-use process::process_input;
+use process::{EditorTarget, editor_target, process_input};
use rootasrole_core::file::FileSettings;
use usage::print_usage;
use crate::{cli::editor::start_editing, util::escape_parser_string_vec};
+/// What chsr does without the policy: print the usage for `--help`, or when the arguments
+/// cannot be parsed. `None` when the arguments need the policy, which chsr then reads.
+pub fn usage_without_policy(args: I) -> Option>>
+where
+ I: IntoIterator
- ,
+ S: AsRef,
+{
+ let args = escape_parser_string_vec(args);
+ let pairs = match Cli::parse(Rule::cli, &args) {
+ Ok(pairs) => pairs,
+ Err(e) => return Some(print_usage(e)),
+ };
+ let mut inputs = Inputs::default();
+ for pair in pairs {
+ if let Err(e) = recurse_pair(pair, &mut inputs) {
+ return Some(Err(e));
+ }
+ }
+ (inputs.action == InputAction::Help).then(|| {
+ usage::help();
+ Ok(false)
+ })
+}
+
#[builder]
pub fn main(
#[builder(start_fn)] storage: &mut FileSettings,
@@ -51,17 +75,15 @@ where
if ruleset == &RulesetStatus::NotEnforced {
return Err("Editor mode requires landlock to be enforced.".into());
}
- if let Some(path) = inputs.editor_path {
- if let Some(storage) = storage.get(&path) {
- return start_editing(&path, &mut *storage.as_ref().borrow_mut());
- }
- let file = FileSettings::read_policy(&path, inputs.editor_type.unwrap_or_default())?;
- return start_editing(&path, &mut *file.data.data.as_ref().borrow_mut());
+ // the copy that the editor opens is always in the temporary folder, which Landlock allows
+ let folder = folder.ok_or("the editor needs a temporary folder")?;
+ if inputs.editor_type.is_some() {
+ warn!("--type is ignored: chsr editor edits a file of the policy, in its format");
}
- return start_editing(
- folder.expect("implementation error"),
- &mut *storage.get_root_mut(),
- );
+ return match editor_target(storage, inputs.editor_path.as_deref())? {
+ EditorTarget::Root => start_editing(folder, &mut *storage.get_root_mut()),
+ EditorTarget::Policy(policy) => start_editing(folder, &mut *policy.borrow_mut()),
+ };
}
process_input(storage, inputs)
}
@@ -954,6 +976,921 @@ mod tests {
// chsr o workdir setpolicy (all|none|inherit)
// chsr o workdir (whitelist|blacklist) (add|del|set|purge) /home/user/**
+ #[test]
+ fn test_usage_without_policy() {
+ // printed without the policy
+ assert!(matches!(usage_without_policy(["--help"]), Some(Ok(false))));
+ assert!(matches!(usage_without_policy(["-h"]), Some(Ok(false))));
+ assert!(matches!(
+ usage_without_policy(["not-a-command"]),
+ Some(Err(_))
+ ));
+ // these need the policy
+ assert!(usage_without_policy(["list"]).is_none());
+ assert!(usage_without_policy(["role", "r", "add"]).is_none());
+ assert!(usage_without_policy(["upgrade"]).is_none());
+ }
+
+ /// The policy as saved in the file of the test `name`, which must load again (parsed, not
+ /// opened: the test still holds the lock of the file).
+ fn saved_policy(ctx: &mut TestContext, name: &str) -> Value {
+ ctx.settings.save_all().unwrap();
+ let content = fs::read_to_string(format!("{RAR_CFG_PATH}.{name}")).unwrap();
+ serde_json::from_str::(&content).expect("the saved policy loads again");
+ serde_json::from_str(&content).unwrap()
+ }
+
+ fn saved_role<'v>(saved: &'v Value, role: &str) -> &'v Value {
+ saved["roles"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .find(|r| r["name"] == role)
+ .unwrap()
+ }
+
+ fn saved_task<'v>(saved: &'v Value, role: &str, task: &str) -> &'v Value {
+ saved_role(saved, role)["tasks"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .find(|t| t["name"] == task)
+ .unwrap()
+ }
+
+ #[test]
+ fn test_new_options_hold_only_what_is_set() {
+ let name = "new_options_hold_only_what_is_set";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.settings.get_root().config.as_ref().borrow_mut().options = None;
+ ctx.assert_command_success("o bounding strict");
+ ctx.assert_command_success("r fresh create");
+ ctx.assert_command_success("r fresh o root user");
+ ctx.assert_command_success("r fresh t t1 add");
+ ctx.assert_command_success("r fresh t t1 o path whitelist add /opt/bin");
+ let saved = saved_policy(&mut ctx, name);
+ // the other options stay inherited, not written with the built-in defaults
+ assert_eq!(saved["options"], serde_json::json!({"bounding": "strict"}));
+ assert_eq!(
+ saved_role(&saved, "fresh")["options"],
+ serde_json::json!({"root": "user"})
+ );
+ assert_eq!(
+ saved_task(&saved, "fresh", "t1")["options"],
+ serde_json::json!({"path": {"add": ["/opt/bin"]}})
+ );
+ }
+
+ #[test]
+ fn test_list_edits_on_a_level_without_the_option() {
+ let name = "list_edits_on_a_level_without_the_option";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("r fresh create");
+ ctx.assert_command_success("r fresh t t1 add");
+ ctx.assert_command_success("r fresh t t1 o env whitelist add MYVAR");
+ ctx.assert_command_success("r fresh t t1 o env checklist add TZ");
+ ctx.assert_command_success("r fresh o path blacklist add /tmp");
+ // removing from a list that the level does not define changes nothing
+ ctx.assert_command_success("r fresh o env blacklist del LD_PRELOAD");
+ ctx.assert_command_success("r fresh t t1 o path whitelist del /usr/bin");
+ let saved = saved_policy(&mut ctx, name);
+ assert_eq!(
+ saved_task(&saved, "fresh", "t1")["options"],
+ serde_json::json!({"env": {"keep": ["MYVAR"], "check": ["TZ"]}})
+ );
+ assert_eq!(
+ saved_role(&saved, "fresh")["options"],
+ serde_json::json!({"path": {"sub": ["/tmp"]}})
+ );
+ }
+
+ #[test]
+ fn test_options_timeout() {
+ let name = "options_timeout";
+ let (mut ctx, _defer) = TestContext::new(name);
+ // set changes the fields given and keeps the others
+ ctx.assert_command_success("o timeout set --type tty");
+ ctx.assert_command_success("o timeout set -d 5:00");
+ assert_eq!(
+ saved_policy(&mut ctx, name)["options"]["timeout"],
+ serde_json::json!({"type": "tty", "duration": "00:05:00", "max_usage": 1})
+ );
+ // unset removes the fields named, then the option once nothing is left
+ ctx.assert_command_success("o timeout unset --max-usage");
+ assert_eq!(
+ saved_policy(&mut ctx, name)["options"]["timeout"],
+ serde_json::json!({"type": "tty", "duration": "00:05:00"})
+ );
+ ctx.assert_command_success("o timeout unset --type --duration");
+ assert!(
+ saved_policy(&mut ctx, name)["options"]
+ .get("timeout")
+ .is_none()
+ );
+ // a field that this version does not know is kept
+ ctx.opt(Level::Role)
+ .as_ref()
+ .borrow_mut()
+ .timeout
+ .as_mut()
+ .unwrap()
+ .extra_fields
+ .insert("future".into(), Value::from(1));
+ ctx.assert_command_success("r complete o timeout unset --type --duration --max-usage");
+ ctx.assert_command_success("r complete o timeout set --max-usage 3");
+ // a level without the option
+ ctx.assert_command_success("r fresh create");
+ ctx.assert_command_success("r fresh o timeout set --type uid");
+ // refused, without a change
+ for command in [
+ "o timeout set --type",
+ "o timeout set --duration",
+ "o timeout set --max-usage",
+ ] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ ctx.assert_command_no_change("r complete t t_complete o show timeout");
+ let saved = saved_policy(&mut ctx, name);
+ assert!(saved["options"].get("timeout").is_none());
+ assert_eq!(
+ saved_role(&saved, "complete")["options"]["timeout"],
+ serde_json::json!({"max_usage": 3, "future": 1})
+ );
+ assert_eq!(
+ saved_role(&saved, "fresh")["options"],
+ serde_json::json!({"timeout": {"type": "uid"}})
+ );
+ }
+
+ #[test]
+ fn test_options_env_names() {
+ let name = "options_env_names";
+ let (mut ctx, _defer) = TestContext::new(name);
+ // one letter and patterns, like the policy accepts
+ ctx.assert_command_success("o env whitelist add A");
+ ctx.assert_command_success("o env whitelist add LC_*,*_PROXY");
+ ctx.assert_command_success("o env setlist add Z=1");
+ // a name that the policy refuses is an error, not a panic
+ for command in [
+ "o env whitelist add MY-VAR",
+ "o env whitelist add 1VAR",
+ "o env setlist add BAD*=1",
+ ] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ let saved = saved_policy(&mut ctx, name);
+ assert_eq!(
+ saved["options"]["env"]["keep"],
+ serde_json::json!(["env1", "env2", "A", "LC_*", "*_PROXY"])
+ );
+ assert_eq!(saved["options"]["env"]["set"]["Z"], "1");
+ assert!(saved["options"]["env"]["set"].get("BAD*").is_none());
+ }
+
+ #[test]
+ fn test_options_show_every_option_at_every_level() {
+ let (mut ctx, _defer) = TestContext::new("options_show_every_option_at_every_level");
+ for level in ["", "r complete ", "r complete t t_complete "] {
+ for option in [
+ "",
+ "all",
+ "path",
+ "env",
+ "root",
+ "bounding",
+ "timeout",
+ "password",
+ "authentication",
+ "auth",
+ "execinfo",
+ "info",
+ "umask",
+ "mask",
+ "workdir",
+ ] {
+ ctx.assert_command_no_change(format!("{level}o show {option}").trim_end());
+ }
+ // not options: refused, never a panic
+ for option in ["cmd", "cred"] {
+ assert!(ctx.run_command(&format!("{level}o show {option}")).is_err());
+ }
+ }
+ }
+
+ #[test]
+ fn test_missing_targets_are_errors() {
+ let (mut ctx, _defer) = TestContext::new("missing_targets_are_errors");
+ for command in [
+ "r complete t nope purge",
+ "r complete t nope show",
+ "r nope t t1 purge",
+ "r nope o root user",
+ "r complete t nope o root user",
+ ] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ // purges that the grammar accepts, whatever they do, never panic
+ for command in [
+ "r complete t t_complete cmd whitelist purge",
+ "r complete t t_complete cred caps whitelist purge",
+ "o workdir blacklist purge",
+ "o env setlist purge",
+ ] {
+ let _ = ctx.run_command(command);
+ }
+ }
+
+ /// The paths of the fields named `future` in `value`.
+ fn future_fields(value: &Value, prefix: &str, out: &mut Vec) {
+ match value {
+ Value::Object(map) => {
+ for (key, value) in map {
+ let path = format!("{prefix}/{key}");
+ if key == "future" {
+ out.push(path.clone());
+ }
+ future_fields(value, &path, out);
+ }
+ }
+ Value::Array(items) => {
+ for (i, value) in items.iter().enumerate() {
+ future_fields(value, &format!("{prefix}[{i}]"), out);
+ }
+ }
+ _ => {}
+ }
+ }
+
+ #[test]
+ fn test_unknown_fields_survive_a_save() {
+ let path = format!("{RAR_CFG_PATH}.unknown_fields_survive_a_save");
+ let _cleanup = defer(|| {
+ let _ = fs::remove_file(format!("{RAR_CFG_PATH}.unknown_fields_survive_a_save"));
+ });
+ // the credential sets (setuid, setgid, capabilities) refuse unknown fields, as dosr does
+ let policy = serde_json::json!({
+ "version": rootasrole_core::PACKAGE_VERSION.to_string(),
+ "future": 1,
+ "storage": {"method": "json", "settings": {"path": path, "future": 1}, "future": 1},
+ "options": {"future": 1,
+ "path": {"default": "delete", "add": ["/usr/bin"], "future": 1},
+ "env": {"default": "delete", "keep": ["A"], "future": 1},
+ "timeout": {"type": "tty", "future": 1},
+ "password": {"tries": 3, "future": 1},
+ "workdir": {"default": "all", "fallback": "/", "future": 1}},
+ "roles": [{"name": "r", "future": 1,
+ "actors": [{"type": "user", "id": 0, "future": 1},
+ {"type": "group", "groups": ["root"], "future": 1}],
+ "options": {"future": 1, "path": {"default": "keep-safe", "future": 1}},
+ "tasks": [{"name": "t", "future": 1,
+ "cred": {"future": 1,
+ "setuid": {"default": "all", "fallback": "root"},
+ "setgid": {"default": "all", "fallback": ["root"]},
+ "capabilities": {"default": "none", "add": ["CAP_NET_RAW"]}},
+ "commands": {"default": "none", "add": ["/usr/bin/ls"], "future": 1},
+ "options": {"future": 1}}]}]
+ });
+ fs::write(&path, serde_json::to_string_pretty(&policy).unwrap()).unwrap();
+ let mut settings =
+ FileSettings::write_all(path.clone(), path.clone(), StorageMethod::JSON).unwrap();
+ assert!(
+ main(&mut settings, "o bounding strict".split(' '))
+ .call()
+ .unwrap()
+ );
+ settings.save_all().unwrap();
+ drop(settings);
+ let saved: Value = serde_json::from_str(&fs::read_to_string(&path).unwrap()).unwrap();
+ let (mut before, mut after) = (Vec::new(), Vec::new());
+ future_fields(&policy, "", &mut before);
+ future_fields(&saved, "", &mut after);
+ assert_eq!(before.len(), 18);
+ let lost: Vec<_> = before
+ .iter()
+ .filter(|field| !after.contains(field))
+ .collect();
+ assert!(lost.is_empty(), "lost: {lost:?}");
+ }
+
+ #[test]
+ fn test_purge_returns_to_inheritance() {
+ let name = "purge_returns_to_inheritance";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("o workdir whitelist add /srv");
+ ctx.assert_command_success("o workdir blacklist add /tmp");
+ // the level no longer defines the list, the upper ones apply again
+ for command in [
+ "o path whitelist purge",
+ "o path blacklist purge",
+ "o workdir whitelist purge",
+ "o env checklist purge",
+ "o env blacklist purge",
+ ] {
+ ctx.assert_command_success(command);
+ }
+ let policy = saved_policy(&mut ctx, name);
+ let options = &policy["options"];
+ assert!(options["path"].get("add").is_none(), "{options}");
+ assert!(options["path"].get("sub").is_none(), "{options}");
+ assert!(options["workdir"].get("add").is_none(), "{options}");
+ assert_eq!(options["workdir"]["sub"], serde_json::json!(["/tmp"]));
+ assert!(options["env"].get("check").is_none(), "{options}");
+ assert!(options["env"].get("delete").is_none(), "{options}");
+ // on a level without the option, nothing changes
+ ctx.assert_command_success("r fresh create");
+ ctx.assert_command_success("r fresh o path blacklist purge");
+ ctx.assert_command_success("r fresh o workdir whitelist purge");
+ let policy = saved_policy(&mut ctx, name);
+ assert!(saved_role(&policy, "fresh").get("options").is_none());
+ }
+
+ #[test]
+ fn test_env_keep_only_keeps_the_other_fields() {
+ let name = "env_keep_only_keeps_the_other_fields";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("o env keep-only A,B");
+ let env = saved_policy(&mut ctx, name)["options"]["env"].clone();
+ assert_eq!(
+ env,
+ serde_json::json!({
+ "default": "delete",
+ "keep": ["A", "B"],
+ "check": ["env3", "env4"],
+ "delete": ["env5", "env6"],
+ "set": {"env7": "val7", "env8": "val8"}
+ })
+ );
+ ctx.assert_command_success("o env delete-only C");
+ let env = saved_policy(&mut ctx, name)["options"]["env"].clone();
+ assert_eq!(env["default"], "keep");
+ assert_eq!(env["delete"], serde_json::json!(["C"]));
+ assert_eq!(env["keep"], serde_json::json!(["A", "B"]));
+ assert_eq!(env["check"], serde_json::json!(["env3", "env4"]));
+ }
+
+ #[test]
+ fn test_simple_edits_are_saved() {
+ let name = "simple_edits_are_saved";
+ let (mut ctx, _defer) = TestContext::new(name);
+ for command in [
+ "o root user",
+ "o bounding strict",
+ "o auth skip",
+ "o info hide",
+ "o umask 077",
+ "r complete o root user",
+ "r complete o umask 027",
+ "r complete t t_complete o workdir set /srv",
+ "r complete t t_complete o auth perform",
+ "r complete grant -u alice -g staff&wheel",
+ "r complete t t_complete cred set --setuid root --setgid root,adm",
+ "r complete t t_complete cred caps whitelist add cap_net_raw",
+ "r complete t t_complete cmd whitelist add /usr/bin/id -u",
+ "r complete t t_complete cmd setpolicy deny-all",
+ "r complete t t2 add",
+ ] {
+ ctx.assert_command_success(command);
+ }
+ let saved = saved_policy(&mut ctx, name);
+ let global = &saved["options"];
+ assert_eq!(global["root"], "user");
+ assert_eq!(global["bounding"], "strict");
+ assert_eq!(global["authentication"], "skip");
+ assert_eq!(global["execinfo"], "hide");
+ assert_eq!(global["umask"], "077");
+ let role = saved_role(&saved, "complete");
+ assert_eq!(role["options"]["root"], "user");
+ assert_eq!(role["options"]["umask"], "027");
+ let actors = role["actors"].as_array().unwrap();
+ assert!(actors.contains(&serde_json::json!({"type": "user", "id": "alice"})));
+ assert!(
+ actors.contains(&serde_json::json!({"type": "group", "groups": ["staff", "wheel"]}))
+ );
+ let task = saved_task(&saved, "complete", "t_complete");
+ assert_eq!(task["options"]["workdir"], "/srv");
+ assert_eq!(task["options"]["authentication"], "perform");
+ assert_eq!(task["cred"]["setuid"], "root");
+ assert_eq!(task["cred"]["setgid"], serde_json::json!(["root", "adm"]));
+ assert!(
+ task["cred"]["capabilities"]["add"]
+ .as_array()
+ .unwrap()
+ .contains(&Value::from("NET_RAW"))
+ );
+ assert_eq!(task["commands"]["default"], "none");
+ assert!(
+ task["commands"]["add"]
+ .as_array()
+ .unwrap()
+ .contains(&Value::from("/usr/bin/id -u"))
+ );
+ assert_eq!(saved_task(&saved, "complete", "t2")["name"], "t2");
+ // deletions
+ for command in ["o root del", "o umask del", "r complete t t2 del"] {
+ ctx.assert_command_success(command);
+ }
+ let saved = saved_policy(&mut ctx, name);
+ assert!(saved["options"].get("root").is_none());
+ assert!(saved["options"].get("umask").is_none());
+ assert!(
+ saved_role(&saved, "complete")["tasks"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .all(|task| task["name"] != "t2")
+ );
+ }
+
+ #[test]
+ fn test_cred_setuid_and_setgid_forms() {
+ let name = "cred_setuid_and_setgid_forms";
+ let (mut ctx, _defer) = TestContext::new(name);
+ for (command, setuid, setgid) in [
+ (
+ "r complete t t_complete cred set -u root -g adm",
+ "root",
+ serde_json::json!("adm"),
+ ),
+ (
+ "r complete t t_complete cred set --setuid=nobody --setgid=root&adm",
+ "nobody",
+ serde_json::json!(["root", "adm"]),
+ ),
+ (
+ "r complete t t_complete cred set --setuid daemon --setgid root,adm,staff",
+ "daemon",
+ serde_json::json!(["root", "adm", "staff"]),
+ ),
+ ] {
+ ctx.assert_command_success(command);
+ let saved = saved_policy(&mut ctx, name);
+ let cred = &saved_task(&saved, "complete", "t_complete")["cred"];
+ assert_eq!(cred["setuid"], setuid, "{command}");
+ assert_eq!(cred["setgid"], setgid, "{command}");
+ }
+ }
+
+ #[test]
+ fn test_umask_is_octal() {
+ let (mut ctx, _defer) = TestContext::new("umask_is_octal");
+ for command in ["o umask 999", "o umask 1000", "o umask 7777"] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ assert!(ctx.opt(Level::Global).as_ref().borrow().umask.is_none());
+ }
+
+ /// A root file pointing to a policy directory holding `files`, as the Debian package and
+ /// `cargo xtask install` lay them out. Returns the root file and the directory.
+ fn policy_directory(
+ name: &str,
+ files: &[(&str, Value)],
+ ) -> (String, String, impl Drop + use<>) {
+ let root = format!("{RAR_CFG_PATH}.{name}");
+ let dir = format!("{RAR_CFG_PATH}.{name}.d");
+ let _ = fs::remove_dir_all(&dir);
+ fs::create_dir_all(&dir).unwrap();
+ let version = rootasrole_core::PACKAGE_VERSION.to_string();
+ fs::write(
+ &root,
+ serde_json::to_string_pretty(&serde_json::json!({
+ "version": version,
+ "storage": {"method": "json", "settings": {"path": dir, "immutable": false}}
+ }))
+ .unwrap(),
+ )
+ .unwrap();
+ for (file, policy) in files {
+ let mut policy = policy.clone();
+ policy["version"] = Value::from(version.clone());
+ fs::write(
+ format!("{dir}/{file}"),
+ serde_json::to_string_pretty(&policy).unwrap(),
+ )
+ .unwrap();
+ }
+ let (root_cleanup, dir_cleanup) = (root.clone(), dir.clone());
+ let cleanup = defer(move || {
+ let _ = fs::remove_file(&root_cleanup);
+ let _ = fs::remove_dir_all(&dir_cleanup);
+ });
+ (root, dir, cleanup)
+ }
+
+ /// Run `command` with chsr on the policy of `root`, and save it like chsr does.
+ fn chsr_on(root: &str, command: &str) -> Result> {
+ let mut settings =
+ FileSettings::write_all(root.to_string(), root.to_string(), StorageMethod::JSON)?;
+ let changed = main(&mut settings, command.split(' ')).call()?;
+ if changed {
+ settings.save_all()?;
+ }
+ Ok(changed)
+ }
+
+ fn role_names(path: &str) -> Vec {
+ let policy: Value = serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap();
+ policy["roles"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .map(|role| role["name"].as_str().unwrap().to_string())
+ .collect()
+ }
+
+ #[test]
+ fn test_policy_directory_targets_one_file() {
+ let (root, dir, _cleanup) = policy_directory(
+ "policy_directory_targets_one_file",
+ &[
+ ("default.json", serde_json::json!({"roles": []})),
+ (
+ "extra.json",
+ serde_json::json!({"roles": [{"name": "x", "actors": [{"user": "root"}]}]}),
+ ),
+ ],
+ );
+ let (default, extra) = (format!("{dir}/default.json"), format!("{dir}/extra.json"));
+ let root_before = fs::read_to_string(&root).unwrap();
+ let extra_before = fs::read_to_string(&extra).unwrap();
+ // without a file named, the role goes to default.json, the files that did not change
+ // are not written again (extra.json keeps its short form)
+ assert!(chsr_on(&root, "r newrole create").unwrap());
+ assert_eq!(role_names(&default), ["newrole"]);
+ assert_eq!(fs::read_to_string(&root).unwrap(), root_before);
+ assert_eq!(fs::read_to_string(&extra).unwrap(), extra_before);
+ // a file named by its name in the directory, or by its path
+ let default_before = fs::read_to_string(&default).unwrap();
+ assert!(chsr_on(&root, "file extra.json r other create").unwrap());
+ assert!(chsr_on(&root, &format!("file {extra} r another create")).unwrap());
+ assert_eq!(role_names(&extra), ["x", "other", "another"]);
+ assert_eq!(fs::read_to_string(&default).unwrap(), default_before);
+ assert!(chsr_on(&root, "file extra.json r x grant -u daemon").unwrap());
+ // a file that is not one of the policy
+ assert!(chsr_on(&root, "file nope.json r y create").is_err());
+ assert!(chsr_on(&root, "file /etc/passwd r y create").is_err());
+ // listings change nothing
+ assert!(!chsr_on(&root, "list").unwrap());
+ assert!(!chsr_on(&root, "file list").unwrap());
+ assert!(!chsr_on(&root, "file extra.json list").unwrap());
+ assert_eq!(fs::read_to_string(&default).unwrap(), default_before);
+ }
+
+ #[test]
+ fn test_a_file_that_cannot_be_loaded_says_why() {
+ let (root, dir, _cleanup) = policy_directory(
+ "a_file_that_cannot_be_loaded_says_why",
+ &[("default.json", serde_json::json!({"roles": []}))],
+ );
+ // written by hand without its version: dosr reads it, chsr does not edit it
+ fs::write(format!("{dir}/broken.json"), r#"{"roles": []}"#).unwrap();
+ for name in ["broken.json".to_string(), format!("{dir}/broken.json")] {
+ let error = chsr_on(&root, &format!("file {name} r y create"))
+ .unwrap_err()
+ .to_string();
+ assert!(
+ error.contains("cannot be loaded") && error.contains("version"),
+ "{error}"
+ );
+ }
+ let error = chsr_on(&root, "file nope.json r y create")
+ .unwrap_err()
+ .to_string();
+ assert!(error.contains("is not a file of the policy"), "{error}");
+ }
+
+ #[test]
+ fn test_editor_edits_the_file_of_the_other_commands() {
+ let (root, dir, _cleanup) = policy_directory(
+ "editor_edits_the_file_of_the_other_commands",
+ &[
+ ("default.json", serde_json::json!({"roles": []})),
+ ("extra.json", serde_json::json!({"roles": []})),
+ ],
+ );
+ let settings =
+ FileSettings::write_all(root.clone(), root.clone(), StorageMethod::JSON).unwrap();
+ let file = |name: &str| {
+ Rc::clone(
+ settings
+ .get(std::path::Path::new(&format!("{dir}/{name}")))
+ .unwrap(),
+ )
+ };
+ let edits = |path: Option<&str>, expected: &Rc>| match editor_target(
+ &settings,
+ path.map(std::path::Path::new),
+ )
+ .unwrap()
+ {
+ EditorTarget::Policy(policy) => assert!(Rc::ptr_eq(&policy, expected), "{path:?}"),
+ EditorTarget::Root => panic!("{path:?} opened the root file"),
+ };
+ // without a path, default.json of the directory, like chsr r newrole create
+ edits(None, &file("default.json"));
+ // another file, by its name or by its path
+ edits(Some("extra.json"), &file("extra.json"));
+ edits(Some(&format!("{dir}/extra.json")), &file("extra.json"));
+ // the root file, by its path
+ assert!(matches!(
+ editor_target(&settings, Some(std::path::Path::new(&root))).unwrap(),
+ EditorTarget::Root
+ ));
+ // a file that is not one of the policy is refused, instead of edited and never saved
+ assert!(editor_target(&settings, Some(std::path::Path::new("nope.json"))).is_err());
+ assert!(editor_target(&settings, Some(std::path::Path::new("/etc/passwd"))).is_err());
+ }
+
+ #[test]
+ fn test_policy_directory_without_default_file() {
+ let (root, dir, _cleanup) = policy_directory(
+ "policy_directory_without_default_file",
+ &[
+ ("a.json", serde_json::json!({"roles": []})),
+ ("b.json", serde_json::json!({"roles": []})),
+ ],
+ );
+ // which file a role belongs to is not guessed
+ let error = chsr_on(&root, "r y create").unwrap_err().to_string();
+ assert!(error.contains("chsr file"), "{error}");
+ assert!(chsr_on(&root, "file b.json r y create").unwrap());
+ assert_eq!(role_names(&format!("{dir}/b.json")), ["y"]);
+ assert!(role_names(&format!("{dir}/a.json")).is_empty());
+ }
+
+ #[test]
+ fn test_role_links() {
+ let name = "role_links";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("r auditor create");
+ ctx.assert_command_success("r junior create");
+ ctx.assert_command_success("r complete ssd add auditor");
+ ctx.assert_command_success("r complete ssd add auditor,other");
+ ctx.assert_command_success("r complete parents set junior");
+ let saved = saved_policy(&mut ctx, name);
+ let role = saved_role(&saved, "complete");
+ assert_eq!(role["ssd"], serde_json::json!(["auditor", "other"]));
+ assert_eq!(role["parents"], serde_json::json!(["junior"]));
+ // del and purge change the links, never the role (del also deletes a role)
+ ctx.assert_command_success("r complete ssd del other");
+ ctx.assert_command_success("r complete parents purge");
+ let saved = saved_policy(&mut ctx, name);
+ let role = saved_role(&saved, "complete");
+ assert_eq!(role["ssd"], serde_json::json!(["auditor"]));
+ assert!(role.get("parents").is_none());
+ // a role cannot exclude itself or be its own parent
+ assert!(ctx.run_command("r complete ssd add complete").is_err());
+ assert!(
+ ctx.run_command("r complete parents add junior,complete")
+ .is_err()
+ );
+ assert!(ctx.run_command("r nope ssd add auditor").is_err());
+ }
+
+ #[test]
+ fn test_task_purpose() {
+ let name = "task_purpose";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("r complete t t_complete purpose set Back up the \"databases\"");
+ let saved = saved_policy(&mut ctx, name);
+ assert_eq!(
+ saved_task(&saved, "complete", "t_complete")["purpose"],
+ "Back up the databases"
+ );
+ // unset removes the purpose, never the task (unset also deletes a task)
+ ctx.assert_command_success("r complete t t_complete purpose unset");
+ let saved = saved_policy(&mut ctx, name);
+ assert!(
+ saved_task(&saved, "complete", "t_complete")
+ .get("purpose")
+ .is_none()
+ );
+ assert!(ctx.run_command("r complete t nope purpose set x").is_err());
+ }
+
+ #[test]
+ fn test_options_env_override() {
+ let name = "options_env_override";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("o env override allow");
+ ctx.assert_command_success("r complete t t_complete o env override deny");
+ ctx.assert_command_success("r fresh create");
+ ctx.assert_command_success("r fresh o env override allow");
+ let saved = saved_policy(&mut ctx, name);
+ assert_eq!(saved["options"]["env"]["override_behavior"], true);
+ assert_eq!(
+ saved_task(&saved, "complete", "t_complete")["options"]["env"]["override_behavior"],
+ false
+ );
+ assert_eq!(
+ saved_role(&saved, "fresh")["options"],
+ serde_json::json!({"env": {"override_behavior": true}})
+ );
+ ctx.assert_command_success("o env override unset");
+ assert!(
+ saved_policy(&mut ctx, name)["options"]["env"]
+ .get("override_behavior")
+ .is_none()
+ );
+ }
+
+ #[test]
+ fn test_commands_with_checks() {
+ let name = "commands_with_checks";
+ let (mut ctx, _defer) = TestContext::new(name);
+ let hash = "a".repeat(64);
+ ctx.assert_command_success(&format!(
+ "r complete t t_complete cmd whitelist add --sha256 {hash} --read-only /usr/bin/id -u"
+ ));
+ ctx.assert_command_success(
+ "r complete t t_complete cmd blacklist add --immutable /usr/bin/rm",
+ );
+ let saved = saved_policy(&mut ctx, name);
+ let commands = &saved_task(&saved, "complete", "t_complete")["commands"];
+ assert!(commands["add"].as_array().unwrap().contains(
+ &serde_json::json!({"command": "/usr/bin/id -u", "sha256": hash, "read_only": true})
+ ));
+ assert!(
+ commands["del"]
+ .as_array()
+ .unwrap()
+ .contains(&serde_json::json!({"command": "/usr/bin/rm", "immutable": true}))
+ );
+ // the same command line in either form is the same command
+ assert!(
+ ctx.run_command("r complete t t_complete cmd whitelist add /usr/bin/id -u")
+ .is_err()
+ );
+ ctx.assert_command_success("r complete t t_complete cmd whitelist del /usr/bin/id -u");
+ let saved = saved_policy(&mut ctx, name);
+ let add = &saved_task(&saved, "complete", "t_complete")["commands"]["add"];
+ assert!(!add.to_string().contains("/usr/bin/id -u"), "{add}");
+ // a hash of the wrong length, or not hexadecimal
+ for command in [
+ "r complete t t_complete cmd whitelist add --sha256 abcd /usr/bin/ls",
+ "r complete t t_complete cmd whitelist add --sha512 zz /usr/bin/ls",
+ ] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ }
+
+ /// The password option of `level`, as (tries, delay in seconds, unknown fields).
+ fn password(ctx: &TestContext, level: Level) -> Option<(Option, Option, usize)> {
+ ctx.opt(level)
+ .as_ref()
+ .borrow()
+ .password
+ .as_ref()
+ .map(|password| {
+ (
+ password.tries.map(std::num::NonZeroU8::get),
+ password.delay.map(|delay| delay.as_secs()),
+ password.extra_fields.len(),
+ )
+ })
+ }
+
+ #[test]
+ fn test_options_password() {
+ let name = "options_password";
+ let (mut ctx, _defer) = TestContext::new(name);
+ // at each level; set changes the fields given and keeps the others
+ ctx.assert_command_success("o password set --tries 5 --delay 00:00:10");
+ ctx.assert_command_success("r complete o password set --tries=4");
+ ctx.assert_command_success("r complete t t_complete o password set -d 2");
+ assert_eq!(password(&ctx, Level::Global), Some((Some(5), Some(10), 0)));
+ assert_eq!(password(&ctx, Level::Role), Some((Some(4), None, 0)));
+ assert_eq!(password(&ctx, Level::Task), Some((None, Some(2), 0)));
+ ctx.assert_command_success("o password set --delay 1:00");
+ assert_eq!(password(&ctx, Level::Global), Some((Some(5), Some(60), 0)));
+ // unset removes the fields named, then the option once nothing is left
+ ctx.assert_command_success("o password unset --tries");
+ assert_eq!(password(&ctx, Level::Global), Some((None, Some(60), 0)));
+ ctx.assert_command_success("o password unset -d");
+ assert_eq!(password(&ctx, Level::Global), None);
+ // a field that this version does not know is kept
+ ctx.opt(Level::Role)
+ .as_ref()
+ .borrow_mut()
+ .password
+ .as_mut()
+ .unwrap()
+ .extra_fields
+ .insert("future".into(), Value::from(1));
+ ctx.assert_command_success("r complete o password unset --tries");
+ assert_eq!(password(&ctx, Level::Role), Some((None, None, 1)));
+ ctx.assert_command_success("r complete o password set --tries 4");
+ assert_eq!(password(&ctx, Level::Role), Some((Some(4), None, 1)));
+ // refused, without a change
+ for command in [
+ "o password set --tries 0",
+ "o password set --tries 256",
+ "o password set --tries",
+ "o password set --delay",
+ "o password set --delay 153722867280912930:59:59",
+ ] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ assert_eq!(password(&ctx, Level::Global), None);
+ ctx.assert_command_no_change("r complete t t_complete o show password");
+ // what is saved is what dosr reads
+ ctx.settings.save_all().unwrap();
+ let saved: Value =
+ serde_json::from_str(&fs::read_to_string(format!("{RAR_CFG_PATH}.{name}")).unwrap())
+ .unwrap();
+ let role = saved["roles"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .find(|role| role["name"] == "complete")
+ .unwrap();
+ assert_eq!(
+ role["options"]["password"],
+ serde_json::json!({"tries": 4, "future": 1})
+ );
+ let task = role["tasks"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .find(|task| task["name"] == "t_complete")
+ .unwrap();
+ assert_eq!(
+ task["options"]["password"],
+ serde_json::json!({"delay": "00:00:02"})
+ );
+ assert!(saved["options"].get("password").is_none());
+ }
+
+ /// The tty option of `level`, as (owner, unknown fields).
+ fn tty(ctx: &TestContext, level: Level) -> Option<(Option, usize)> {
+ ctx.opt(level)
+ .as_ref()
+ .borrow()
+ .tty
+ .as_ref()
+ .map(|tty| (tty.owner, tty.extra_fields.len()))
+ }
+
+ #[test]
+ fn test_options_tty() {
+ let name = "options_tty";
+ let (mut ctx, _defer) = TestContext::new(name);
+ ctx.assert_command_success("o tty owner target");
+ ctx.assert_command_success("r complete o tty owner caller");
+ ctx.assert_command_success("r complete t t_complete o tty owner target");
+ assert_eq!(tty(&ctx, Level::Global), Some((Some(TtyOwner::Target), 0)));
+ assert_eq!(tty(&ctx, Level::Role), Some((Some(TtyOwner::Caller), 0)));
+ assert_eq!(tty(&ctx, Level::Task), Some((Some(TtyOwner::Target), 0)));
+ // unset removes the option, unless it has fields that this version does not know
+ ctx.assert_command_success("o tty owner unset");
+ assert_eq!(tty(&ctx, Level::Global), None);
+ ctx.opt(Level::Role)
+ .as_ref()
+ .borrow_mut()
+ .tty
+ .as_mut()
+ .unwrap()
+ .extra_fields
+ .insert("future".into(), Value::from(1));
+ ctx.assert_command_success("r complete o tty owner unset");
+ assert_eq!(tty(&ctx, Level::Role), Some((None, 1)));
+ ctx.assert_command_success("r complete o tty owner target");
+ assert_eq!(tty(&ctx, Level::Role), Some((Some(TtyOwner::Target), 1)));
+ // refused, without a change; "t" stays the alias of timeout
+ for command in ["o tty owner root", "o tty owner", "o tty target", "o tty"] {
+ assert!(ctx.run_command(command).is_err(), "{command}");
+ }
+ assert_eq!(tty(&ctx, Level::Global), None);
+ ctx.assert_command_success("o t set --type tty");
+ ctx.assert_command_no_change("r complete t t_complete o show tty");
+ // what is saved is what dosr reads
+ ctx.settings.save_all().unwrap();
+ let saved: Value =
+ serde_json::from_str(&fs::read_to_string(format!("{RAR_CFG_PATH}.{name}")).unwrap())
+ .unwrap();
+ let role = saved["roles"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .find(|role| role["name"] == "complete")
+ .unwrap();
+ assert_eq!(
+ role["options"]["tty"],
+ serde_json::json!({"owner": "target", "future": 1})
+ );
+ let task = role["tasks"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .find(|task| task["name"] == "t_complete")
+ .unwrap();
+ assert_eq!(
+ task["options"]["tty"],
+ serde_json::json!({"owner": "target"})
+ );
+ assert!(saved["options"].get("tty").is_none());
+ assert_eq!(saved["options"]["timeout"]["type"], "tty");
+ }
+
#[test]
fn test_all_main() {
let (mut ctx, _defer) = TestContext::new("all_main");
@@ -1088,6 +2025,93 @@ mod tests {
ctx.assert_command_not_contains(&command);
}
#[test]
+ fn test_cred_setgid_from() {
+ let (mut ctx, _defer) = TestContext::new("cred_setgid_from");
+ let setgid = |ctx: &TestContext| {
+ serde_json::to_value(&ctx.task().as_ref().borrow().cred.setgid).unwrap()
+ };
+ ctx.assert_command_success("r complete t t_complete cred unset --setgid group1");
+ // a task without setgid gets a selector with from
+ ctx.assert_command_success("r complete t t_complete cred set --setgid-from caller");
+ assert_eq!(
+ setgid(&ctx),
+ serde_json::json!({"default": "none", "from": "caller"})
+ );
+ // forcing groups and taking them from someone cannot go together
+ assert!(
+ ctx.run_command(
+ "r complete t t_complete cred set --setgid group1 --setgid-from caller"
+ )
+ .is_err()
+ );
+ // a selector keeps its fields, only from changes
+ ctx.task().as_ref().borrow_mut().cred.setgid = Some(SGroupsEither::GroupSelector(
+ SSetgidSet::builder(SetBehavior::None)
+ .add([SGroups::from(vec![
+ rootasrole_core::database::actor::SGroupType::from("adm"),
+ ])])
+ .build(),
+ ));
+ ctx.assert_command_success("r complete t t_complete cred set --setgid-from=target");
+ assert_eq!(
+ setgid(&ctx),
+ serde_json::json!({"default": "none", "add": ["adm"], "from": "target"})
+ );
+ ctx.assert_command_success("r complete t t_complete cred unset --setgid-from target");
+ assert_eq!(
+ setgid(&ctx),
+ serde_json::json!({"default": "none", "add": ["adm"]})
+ );
+ // a selector with nothing else than from is removed with it
+ ctx.assert_command_success("r complete t t_complete cred unset --setgid group1");
+ ctx.assert_command_success("r complete t t_complete cred set --setgid-from caller");
+ ctx.assert_command_success("r complete t t_complete cred unset --setgid-from caller");
+ ctx.assert_setgid_is_none();
+ assert!(
+ ctx.run_command("r complete t t_complete cred unset --setgid-from caller")
+ .is_err()
+ );
+ }
+
+ #[test]
+ fn test_cmd_whitelist_keeps_a_regular_expression_as_typed() {
+ let (mut ctx, _defer) =
+ TestContext::new("cmd_whitelist_keeps_a_regular_expression_as_typed");
+ let prefix = ["r", "complete", "t", "t_complete", "cmd", "whitelist"];
+ let typed = "/usr/bin/tail ^(-n [0-9]+|-f) /var/log/caddy/[^/ ]+$";
+ let command = SCommand::Simple(typed.to_string());
+
+ // quoted as one argument by the shell
+ ctx.assert_command_vec_success([&prefix[..], &["add", typed]].concat());
+ ctx.assert_command_contains(&command);
+ // dosr reads it as a regular expression, with the same rule of rootasrole-core
+ let (_, args) = rootasrole_core::database::command::split_command(typed).unwrap();
+ assert_eq!(
+ rootasrole_core::database::command::regex_arguments(args),
+ Some("^(-n [0-9]+|-f) /var/log/caddy/[^/ ]+$")
+ );
+
+ // del finds it, typed as several arguments
+ ctx.assert_command_vec_success(
+ [
+ &prefix[..],
+ &[
+ "del",
+ "/usr/bin/tail",
+ "^(-n [0-9]+|-f)",
+ "/var/log/caddy/[^/ ]+$",
+ ],
+ ]
+ .concat(),
+ );
+ ctx.assert_command_not_contains(&command);
+
+ // a backslash is kept, where shell splitting removes it
+ let escaped = r"/usr/bin/tail ^-f /var/log/caddy/access\.log$";
+ ctx.assert_command_vec_success([&prefix[..], &["add", escaped]].concat());
+ ctx.assert_command_contains(&SCommand::Simple(escaped.to_string()));
+ }
+ #[test]
fn test_r_complete_t_t_complete_cmd_blacklist_del_super_command_with_spaces() {
let (mut ctx, _defer) =
TestContext::new("r_complete_t_t_complete_cmd_blacklist_del_super_command_with_spaces");
diff --git a/src/chsr/cli/pair.rs b/src/chsr/cli/pair.rs
index 6137ed5b..40b42382 100644
--- a/src/chsr/cli/pair.rs
+++ b/src/chsr/cli/pair.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, error::Error, str::FromStr};
+use std::{collections::HashMap, error::Error, num::NonZeroU8, str::FromStr};
use capctl::Cap;
use indexmap::IndexSet;
@@ -10,16 +10,38 @@ use crate::cli::data::{Convertion, RoleType, TaskType};
use rootasrole_core::{
database::{
actor::{SActor, SGroupType},
- options::{EnvBehavior, OptType, PathBehavior, TimestampType, WorkdirBehavior},
- structs::{IdTask, SetBehavior},
+ command::{regex_arguments, split_command},
+ options::{
+ EnvBehavior, EnvKey, OptType, PathBehavior, SUMask, TimestampType, WorkdirBehavior,
+ },
+ structs::{GroupsFrom, IdTask, SetBehavior},
},
- util::StorageMethod,
+ util::{StorageMethod, is_valid_env_name},
};
-use super::data::{InputAction, Inputs, Rule, SetListType, TimeoutOpt};
+use super::data::{
+ EnvOverride, InputAction, Inputs, PasswordOpt, RoleLink, Rule, SetListType, TimeoutOpt,
+};
type MatchingFunction = dyn Fn(&Pair, &mut Inputs) -> Result<(), Box>;
+/// The command line to write in the policy for the command that the user typed.
+///
+/// A regular expression on the arguments is kept as typed: dosr reads it as written, and shell
+/// splitting would quote each of its words, so that it never matches. Any other command is
+/// normalized as a shell splits it.
+///
+/// # Errors
+/// When the command has an unterminated quote.
+pub fn policy_command_line(typed: &str) -> Result {
+ if let Some((path, args)) = split_command(typed)
+ && let Some(regex) = regex_arguments(args)
+ {
+ return Ok(format!("{path} {regex}"));
+ }
+ Ok(shell_words::join(shell_words::split(typed)?))
+}
+
fn recurse_pair_with_action(
pair: Pair,
inputs: &mut Inputs,
@@ -36,6 +58,36 @@ pub fn recurse_pair(pair: Pair, inputs: &mut Inputs) -> Result<(), Box) -> Vec {
+ pair.clone()
+ .into_inner()
+ .flat_map(|inner| {
+ if inner.as_rule() == Rule::actor_name {
+ vec![inner.as_str().to_string()]
+ } else {
+ actor_names(&inner)
+ }
+ })
+ .collect()
+}
+
+/// A duration written `ss`, `mm:ss` or `hh:mm:ss`: a field that does not fit, or a duration
+/// that does not, is an error, never 0 nor a panic.
+fn parse_time(time: &str) -> Result> {
+ let mut seconds: i64 = 0;
+ for field in time.split(':') {
+ let value: i64 = field
+ .parse()
+ .map_err(|_| format!("Invalid duration: {time}"))?;
+ seconds = seconds
+ .checked_mul(60)
+ .and_then(|seconds| seconds.checked_add(value))
+ .ok_or_else(|| format!("Duration too long: {time}"))?;
+ }
+ Ok(SignedDuration::from_secs(seconds))
+}
+
#[allow(clippy::too_many_lines)]
fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box> {
match pair.as_rule() {
@@ -98,7 +150,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box, inputs: &mut Inputs) -> Result<(), Box {
inputs.convert_reconfigure = true;
@@ -129,7 +181,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
@@ -139,7 +191,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
@@ -153,7 +205,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
@@ -165,7 +217,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
@@ -174,31 +226,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
- let mut reversed = pair.as_str().split(':').rev();
- let mut duration: SignedDuration = SignedDuration::from_secs(
- reversed
- .next()
- .ok_or("No seconds in time")?
- .parse::()
- .unwrap_or(0),
- );
- if let Some(mins) = reversed.next() {
- duration = duration
- .checked_add(
- SignedDuration::try_from_mins(mins.parse::().unwrap_or(0))
- .unwrap_or_default(),
- )
- .expect("Invalid minutes");
- if let Some(hours) = reversed.next() {
- duration = duration
- .checked_add(
- SignedDuration::try_from_hours(hours.parse::().unwrap_or(0))
- .unwrap_or_default(),
- )
- .expect("Invalid hours");
- }
- }
- inputs.timeout_duration = Some(duration);
+ inputs.timeout_duration = Some(parse_time(pair.as_str())?);
}
Rule::opt_timeout_type => {
if pair.as_str() == "tty" {
@@ -208,7 +236,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
@@ -229,6 +257,28 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
inputs.timeout_max_usage = Some(pair.as_str().parse::()?);
}
+ Rule::opt_password_t_arg => {
+ let mut password_arg = inputs.password_arg.unwrap_or_default();
+ password_arg[PasswordOpt::Tries as usize] = true;
+ inputs.password_arg.replace(password_arg);
+ }
+ Rule::opt_password_d_arg => {
+ let mut password_arg = inputs.password_arg.unwrap_or_default();
+ password_arg[PasswordOpt::Delay as usize] = true;
+ inputs.password_arg.replace(password_arg);
+ }
+ Rule::opt_password_tries => {
+ let tries = pair
+ .as_str()
+ .parse::()
+ .ok()
+ .and_then(NonZeroU8::new)
+ .ok_or_else(|| format!("The tries must be 1 to 255: {}", pair.as_str()))?;
+ inputs.password_tries = Some(tries);
+ }
+ Rule::opt_password_delay => {
+ inputs.password_delay = Some(parse_time(pair.as_str())?);
+ }
// === file ===
Rule::file => {
inputs.policy = true;
@@ -240,6 +290,77 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
inputs.role_id = Some(pair.as_str().to_string());
}
+ Rule::role_link_kind => {
+ inputs.role_link = Some(if pair.as_str() == "ssd" {
+ RoleLink::Ssd
+ } else {
+ RoleLink::Parents
+ });
+ }
+ Rule::linked_role => {
+ inputs
+ .role_links
+ .get_or_insert_default()
+ .push(pair.as_str().to_string());
+ }
+ Rule::purpose_keyword => {
+ inputs.purpose = true;
+ }
+ Rule::purpose_text => {
+ // the words of the purpose, unquoted like the arguments of a command
+ inputs.task_purpose = Some(shell_words::split(pair.as_str())?.join(" "));
+ }
+ Rule::cmd_hash => {
+ let mut inner = pair.clone().into_inner();
+ let kind = inner
+ .next()
+ .ok_or("a hash type is needed")?
+ .as_str()
+ .trim_start_matches('-')
+ .to_string();
+ let hash = inner
+ .next()
+ .ok_or("a hash is needed")?
+ .as_str()
+ .to_ascii_lowercase();
+ let length = match kind.as_str() {
+ "sha224" => 56,
+ "sha256" => 64,
+ "sha384" => 96,
+ "sha512" => 128,
+ other => return Err(format!("Unknown hash type: {other}").into()),
+ };
+ if !hash.bytes().all(|b| b.is_ascii_hexdigit()) {
+ return Err(format!("A {kind} hash is hexadecimal: {hash}").into());
+ }
+ if hash.len() != length {
+ return Err(format!(
+ "A {kind} hash has {length} hexadecimal digits, this one has {}",
+ hash.len()
+ )
+ .into());
+ }
+ inputs.cmd_checks.hash = Some((kind, hash));
+ }
+ Rule::cmd_check_flag => {
+ if pair.as_str() == "--read-only" {
+ inputs.cmd_checks.read_only = true;
+ } else {
+ inputs.cmd_checks.immutable = true;
+ }
+ }
+ Rule::opt_env_override => {
+ // unset, unless a value follows
+ inputs.options_env_override = Some(EnvOverride::Unset);
+ }
+ Rule::env_override_value => {
+ inputs.action = InputAction::Set;
+ inputs.options_env_override = Some(if pair.as_str() == "allow" {
+ EnvOverride::Allow
+ } else {
+ EnvOverride::Deny
+ });
+ }
Rule::role_type_arg => {
if pair.as_str() == "all" {
inputs.role_type = Some(RoleType::All);
@@ -248,7 +369,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box, inputs: &mut Inputs) -> Result<(), Box {
- inputs.cmd_id = Some(shell_words::split(pair.as_str())?);
+ inputs.cmd_id = Some(policy_command_line(pair.as_str())?);
}
// === credentials ===
Rule::capability => {
@@ -322,26 +443,28 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
- inputs.cred_setuid = Some(
- pair.as_str()
- .chars()
- .skip(9)
- .collect::()
- .as_str()
- .into(),
- );
+ let user = actor_names(pair)
+ .into_iter()
+ .next()
+ .ok_or("--setuid needs a user")?;
+ inputs.cred_setuid = Some(user.as_str().into());
+ }
+ Rule::groups_from => {
+ inputs.cred_groups_from = Some(if pair.as_str() == "caller" {
+ GroupsFrom::Caller
+ } else {
+ GroupsFrom::Target
+ });
}
Rule::cred_g => {
- let mut vec: Vec = Vec::new();
- for pair in pair.clone().into_inner() {
- if pair.as_rule() == Rule::actor_name {
- vec.push(pair.as_str().into());
- }
+ let groups: Vec = actor_names(pair)
+ .iter()
+ .map(|name| name.as_str().into())
+ .collect();
+ if groups.is_empty() {
+ return Err("--setgid needs a group".into());
}
- if vec.is_empty() {
- warn!("No group specified");
- }
- inputs.cred_setgid = Some(vec.into());
+ inputs.cred_setgid = Some(groups.into());
}
// === options ===
Rule::options_operations => {
@@ -381,27 +504,21 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
- if pair.as_str() == "all" {
- inputs.options_type = None;
- } else if pair.as_str() == "path" {
- inputs.options_type = Some(OptType::Path);
- } else if pair.as_str() == "env" {
- inputs.options_type = Some(OptType::Env);
- } else if pair.as_str() == "root" {
- inputs.options_type = Some(OptType::Root);
- } else if pair.as_str() == "bounding" {
- inputs.options_type = Some(OptType::Bounding);
- } else if pair.as_str() == "timeout" {
- inputs.options_type = Some(OptType::Timeout);
- } else if pair.as_str() == "authentication" {
- inputs.options_type = Some(OptType::Authentication);
- } else if pair.as_str() == "execinfo" {
- inputs.options_type = Some(OptType::ExecInfo);
- } else if pair.as_str() == "umask" {
- inputs.options_type = Some(OptType::UMask);
- } else {
- unreachable!("Unknown option type: {}", pair.as_str())
- }
+ inputs.options_type = match pair.as_str() {
+ "all" => None,
+ "path" => Some(OptType::Path),
+ "env" => Some(OptType::Env),
+ "root" => Some(OptType::Root),
+ "bounding" => Some(OptType::Bounding),
+ "timeout" => Some(OptType::Timeout),
+ "password" => Some(OptType::Password),
+ "tty" => Some(OptType::Tty),
+ "authentication" | "auth" => Some(OptType::Authentication),
+ "execinfo" | "info" => Some(OptType::ExecInfo),
+ "umask" | "mask" => Some(OptType::UMask),
+ "workdir" => Some(OptType::Workdir),
+ other => return Err(format!("Unknown option: {other}").into()),
+ };
}
Rule::path => {
inputs.options_path = Some(pair.as_str().to_string());
@@ -423,12 +540,18 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
if let Some(options_env) = inputs.options_key_env.as_mut() {
- options_env.insert(pair.as_str().into());
+ options_env.insert(EnvKey::new(pair.as_str().to_string())?);
}
}
Rule::opt_root_args => {
@@ -447,9 +570,23 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box {
+ inputs.action = InputAction::Set; // If del it will be overwritten by the parse loop
+ inputs.options_tty_owner = Some(pair.as_str().parse().unwrap_or_default());
+ }
Rule::opt_mask_args => {
inputs.action = InputAction::Set; // If del it will be overwritten by the parse loop
- inputs.options_umask = Some(pair.as_str().parse().unwrap_or_default());
+ let value = pair.as_str();
+ inputs.options_umask = Some(if value.bytes().all(|b| b.is_ascii_digit()) {
+ u16::from_str_radix(value, 8)
+ .ok()
+ .filter(|umask| *umask <= 0o777)
+ .map(SUMask)
+ .ok_or_else(|| format!("The umask is octal, 000 to 777: {value}"))?
+ } else {
+ // del: the value is not used
+ SUMask::default()
+ });
}
Rule::all => {
if inputs.role_id.is_some() && inputs.task_id.is_none() {
@@ -467,7 +604,7 @@ fn match_pair(pair: &Pair, inputs: &mut Inputs) -> Result<(), Box String {
shell_words::join(shell_words::split(args).expect("Failed to split args"))
@@ -581,6 +719,33 @@ mod test {
assert_eq!(inputs.role_type, Some(RoleType::Tasks));
}
+ #[test]
+ fn test_parse_time() {
+ assert_eq!(parse_time("5").unwrap(), SignedDuration::from_secs(5));
+ assert_eq!(parse_time("5:00").unwrap(), SignedDuration::from_secs(300));
+ assert_eq!(
+ parse_time("01:02:03").unwrap(),
+ SignedDuration::from_secs(3723)
+ );
+ // too long: an error, never 0 nor a panic
+ assert!(parse_time("99999999999999999999").is_err());
+ assert!(parse_time("153722867280912930:59:59").is_err());
+ }
+
+ #[test]
+ fn test_timeout_duration_too_long_is_an_error() {
+ let binding = make_args("o timeout set --duration 153722867280912930:59:59");
+ let pairs = Cli::parse(Rule::cli, &binding).unwrap();
+ let mut inputs = Inputs::default();
+ assert!(
+ pairs
+ .into_iter()
+ .try_for_each(|pair| recurse_pair(pair, &mut inputs))
+ .is_err()
+ );
+ assert_eq!(inputs.timeout_duration, None);
+ }
+
#[test]
fn test_list_role_all() {
let inputs = get_inputs("r r1 l all");
diff --git a/src/chsr/cli/process.rs b/src/chsr/cli/process.rs
index f0f97588..2234217e 100644
--- a/src/chsr/cli/process.rs
+++ b/src/chsr/cli/process.rs
@@ -2,13 +2,14 @@ mod convert;
mod json;
mod upgrade;
-use std::{cell::RefCell, error::Error, rc::Rc};
+use std::{cell::RefCell, error::Error, ffi::OsStr, path::Path, rc::Rc};
use json::{
cmd_setpolicy, cmd_whitelist_action, cred_caps, cred_set, cred_setpolicy, cred_unset,
- env_set_policylist, env_setlist_add, env_setpolicy, env_whitelist_set, grant_revoke,
- path_purge, path_set, path_setlist2, path_setpolicy, role_add_del, set_authentication,
- set_bounding, set_execinfo, set_privileged, set_timeout, set_umask, task_add_del,
+ edit_role_links, edit_task_purpose, env_set_policylist, env_setlist_add, env_setpolicy,
+ env_whitelist_set, grant_revoke, path_purge, path_set, path_setlist2, path_setpolicy,
+ role_add_del, set_authentication, set_bounding, set_env_override, set_execinfo, set_password,
+ set_privileged, set_timeout, set_tty_owner, set_umask, task_add_del, unset_password,
unset_timeout,
};
@@ -16,10 +17,12 @@ use log::debug;
use rootasrole_core::{
database::{
- options::{Opt, OptType},
- structs::{IdTask, RoleGetter},
+ options::{Level, Opt, OptType},
+ structs::{IdTask, RoleGetter, SPolicy},
},
file::FileSettings,
+ println_ignore_io_error,
+ util::DEFAULT_POLICY_FILE,
};
use crate::cli::process::json::{
@@ -37,9 +40,7 @@ pub fn process_input(storage: &mut FileSettings, inputs: Inputs) -> Result Result Result edit_role_links(
+ rconfig,
+ &role_id,
+ link,
+ action,
+ role_links.unwrap_or_default(),
+ ),
+ Inputs {
+ // chsr role r1 task t1 purpose set , chsr role r1 task t1 purpose unset
+ action,
+ role_id: Some(role_id),
+ task_id: Some(task_id),
+ purpose: true,
+ task_purpose,
+ ..
+ } => edit_task_purpose(rconfig, &role_id, task_id, action, task_purpose),
+ Inputs {
+ // chsr o env override allow|deny|unset
+ role_id,
+ task_id,
+ options_env_override: Some(value),
+ ..
+ } => set_env_override(rconfig, role_id.as_ref(), task_id, value),
+
Inputs {
// chsr role r1 add|del
action,
@@ -118,6 +175,7 @@ pub fn process_input(storage: &mut FileSettings, inputs: Inputs) -> Result Result Result