fix security problem with pty's

SCCS-vsn: libexec/rlogind/rlogind.c 5.14
SCCS-vsn: libexec/telnetd/telnetd.c 5.27

diff --git a/usr/src/libexec/rlogind/rlogind.c b/usr/src/libexec/rlogind/rlogind.c
index eec0cb3..6016c9c 100644 (file)
--- a/usr/src/libexec/rlogind/rlogind.c
+++ b/usr/src/libexec/rlogind/rlogind.c
@@ -11,7 +11,7 @@ char copyright[] =
 #endif not lint
 
 #ifndef lint
 #endif not lint
 
 #ifndef lint

-static char sccsid[] = "@(#)rlogind.c  5.13 (Berkeley) %G%";
+static char sccsid[] = "@(#)rlogind.c  5.14 (Berkeley) %G%";

 #endif not lint
 
 /*
 #endif not lint
 
 /*


@@ -44,16 +44,17 @@ static char sccsid[] = "@(#)rlogind.c       5.13 (Berkeley) %G%";
 # define TIOCPKT_WINDOW 0x80
 # endif TIOCPKT_WINDOW
 
 # define TIOCPKT_WINDOW 0x80
 # endif TIOCPKT_WINDOW
 

-extern errno;
+extern int errno;

 int    reapchild();
 struct passwd *getpwnam();
 char   *malloc();
 
 int    reapchild();
 struct passwd *getpwnam();
 char   *malloc();
 

+/*ARGSUSED*/

 main(argc, argv)
        int argc;
        char **argv;
 {
 main(argc, argv)
        int argc;
        char **argv;
 {

-       int on = 1, options = 0, fromlen;
+       int on = 1, fromlen;

        struct sockaddr_in from;
 
        openlog("rlogind", LOG_PID | LOG_AUTH, LOG_AUTH);
        struct sockaddr_in from;
 
        openlog("rlogind", LOG_PID | LOG_AUTH, LOG_AUTH);


@@ -72,7 +73,6 @@ main(argc, argv)
 int    child;
 int    cleanup();
 int    netf;
 int    child;
 int    cleanup();
 int    netf;

-extern errno;

 char   *line;
 extern char    *inet_ntoa();
 
 char   *line;
 extern char    *inet_ntoa();
 


@@ -116,8 +116,8 @@ doit(f, fromp)
                if (stat(line, &stb) < 0)
                        break;
                for (i = 0; i < 16; i++) {
                if (stat(line, &stb) < 0)
                        break;
                for (i = 0; i < 16; i++) {

-                       line[strlen("/dev/ptyp")] = "0123456789abcdef"[i];
-                       p = open(line, 2);
+                       line[sizeof("/dev/ptyp") - 1] = "0123456789abcdef"[i];
+                       p = open(line, O_RDWR);

                        if (p > 0)
                                goto gotpty;
                }
                        if (p > 0)
                                goto gotpty;
                }


@@ -128,29 +128,42 @@ gotpty:
        (void) ioctl(p, TIOCSWINSZ, &win);
        netf = f;
        line[strlen("/dev/")] = 't';
        (void) ioctl(p, TIOCSWINSZ, &win);
        netf = f;
        line[strlen("/dev/")] = 't';

+       t = open(line, O_RDWR);
+       if (t < 0)
+               fatalperror(f, line);
+       if (fchmod(t, 0))
+               fatalperror(f, line);
+       (void)signal(SIGHUP, SIG_IGN);
+       vhangup();
+       (void)signal(SIGHUP, SIG_DFL);
+       t = open(line, O_RDWR);
+       if (t < 0)
+               fatalperror(f, line);
+       {
+               struct sgttyb b;
+
+               (void)ioctl(t, TIOCGETP, &b);
+               b.sg_flags = RAW|ANYP;
+               (void)ioctl(t, TIOCSETP, &b);
+       }

 #ifdef DEBUG
 #ifdef DEBUG

-       { int tt = open("/dev/tty", 2);
-         if (tt > 0) {
-               ioctl(tt, TIOCNOTTY, 0);
-               close(tt);
-         }
+       {
+               int tt = open("/dev/tty", O_RDWR);
+               if (tt > 0) {
+                       (void)ioctl(tt, TIOCNOTTY, 0);
+                       (void)close(tt);
+               }

        }
 #endif
        }
 #endif

-       t = open(line, 2);
-       if (t < 0)
-               fatalperror(f, line, errno);
-       { struct sgttyb b;
-         gtty(t, &b); b.sg_flags = RAW|ANYP; stty(t, &b);
-       }

        pid = fork();
        if (pid < 0)
        pid = fork();
        if (pid < 0)

-               fatalperror(f, "", errno);
+               fatalperror(f, "");

        if (pid == 0) {
                close(f), close(p);
                dup2(t, 0), dup2(t, 1), dup2(t, 2);
                close(t);
                execl("/bin/login", "login", "-r", hp->h_name, 0);
        if (pid == 0) {
                close(f), close(p);
                dup2(t, 0), dup2(t, 1), dup2(t, 2);
                close(t);
                execl("/bin/login", "login", "-r", hp->h_name, 0);

-               fatalperror(2, "/bin/login", errno);
+               fatalperror(2, "/bin/login");

                /*NOTREACHED*/
        }
        close(t);
                /*NOTREACHED*/
        }
        close(t);


@@ -228,7 +241,7 @@ protocol(f, p)
                if (select(16, &ibits, &obits, &ebits, 0) < 0) {
                        if (errno == EINTR)
                                continue;
                if (select(16, &ibits, &obits, &ebits, 0) < 0) {
                        if (errno == EINTR)
                                continue;

-                       fatalperror(f, "select", errno);
+                       fatalperror(f, "select");

                }
                if (ibits == 0 && obits == 0 && ebits == 0) {
                        /* shouldn't happen... */
                }
                if (ibits == 0 && obits == 0 && ebits == 0) {
                        /* shouldn't happen... */


@@ -337,10 +350,9 @@ fatal(f, msg)
        exit(1);
 }
 
        exit(1);
 }
 

-fatalperror(f, msg, errno)
+fatalperror(f, msg)

        int f;
        char *msg;
        int f;
        char *msg;

-       int errno;

 {
        char buf[BUFSIZ];
        extern int sys_nerr;
 {
        char buf[BUFSIZ];
        extern int sys_nerr;

diff --git a/usr/src/libexec/telnetd/telnetd.c b/usr/src/libexec/telnetd/telnetd.c
index bf80eb2..976d065 100644 (file)
--- a/usr/src/libexec/telnetd/telnetd.c
+++ b/usr/src/libexec/telnetd/telnetd.c
@@ -17,7 +17,7 @@ char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
 #endif /* not lint */
 
 #ifndef lint

-static char sccsid[] = "@(#)telnetd.c  5.26 (Berkeley) %G%";
+static char sccsid[] = "@(#)telnetd.c  5.27 (Berkeley) %G%";

 #endif /* not lint */
 
 /*
 #endif /* not lint */
 
 /*


@@ -258,8 +258,8 @@ doit(f, who)
                if (stat(line, &stb) < 0)
                        break;
                for (i = 0; i < 16; i++) {
                if (stat(line, &stb) < 0)
                        break;
                for (i = 0; i < 16; i++) {

-                       line[strlen("/dev/ptyp")] = "0123456789abcdef"[i];
-                       p = open(line, 2);
+                       line[sizeof("/dev/ptyp") - 1] = "0123456789abcdef"[i];
+                       p = open(line, O_RDWR);

                        if (p > 0)
                                goto gotpty;
                }
                        if (p > 0)
                                goto gotpty;
                }


@@ -276,7 +276,15 @@ gotpty:
        }
        t = open(line, O_RDWR);
        if (t < 0)
        }
        t = open(line, O_RDWR);
        if (t < 0)

-               fatalperror(f, line, errno);
+               fatalperror(f, line);
+       if (fchmod(t, 0))
+               fatalperror(f, line);
+       (void)signal(SIGHUP, SIG_IGN);
+       vhangup();
+       (void)signal(SIGHUP, SIG_DFL);
+       t = open(line, O_RDWR);
+       if (t < 0)
+               fatalperror(f, line);

        ioctl(t, TIOCGETP, &b);
        b.sg_flags = CRMOD|XTABS|ANYP;
        ioctl(t, TIOCSETP, &b);
        ioctl(t, TIOCGETP, &b);
        b.sg_flags = CRMOD|XTABS|ANYP;
        ioctl(t, TIOCSETP, &b);


@@ -299,7 +307,7 @@ gotpty:
        getterminaltype();
 
        if ((i = fork()) < 0)
        getterminaltype();
 
        if ((i = fork()) < 0)

-               fatalperror(f, "fork", errno);
+               fatalperror(f, "fork");

        if (i)
                telnet(f, p);
        close(f);
        if (i)
                telnet(f, p);
        close(f);


@@ -319,7 +327,7 @@ gotpty:
         */
        execl("/bin/login", "login", "-h", host,
                                        terminaltype ? "-p" : 0, 0);
         */
        execl("/bin/login", "login", "-h", host,
                                        terminaltype ? "-p" : 0, 0);

-       fatalperror(f, "/bin/login", errno);
+       fatalperror(f, "/bin/login");

        /*NOTREACHED*/
 }
 
        /*NOTREACHED*/
 }
 


@@ -334,10 +342,9 @@ fatal(f, msg)
        exit(1);
 }
 
        exit(1);
 }
 

-fatalperror(f, msg, errno)
+fatalperror(f, msg)

        int f;
        char *msg;
        int f;
        char *msg;

-       int errno;

 {
        char buf[BUFSIZ];
        extern char *sys_errlist[];
 {
        char buf[BUFSIZ];
        extern char *sys_errlist[];


@@ -366,7 +373,7 @@ int s;              /* socket number */
     } while ((value == -1) && (errno == EINTR));
 
     if (value < 0) {
     } while ((value == -1) && (errno == EINTR));
 
     if (value < 0) {

-       fatalperror(pty, "select", errno);
+       fatalperror(pty, "select");

     }
     if (FD_ISSET(s, &excepts)) {
        return 1;
     }
     if (FD_ISSET(s, &excepts)) {
        return 1;


@@ -449,7 +456,7 @@ telnet(f, p)
                        strcpy(hostname, HN);
                edithost(HE, hostname);
                if (IM && *IM)
                        strcpy(hostname, HN);
                edithost(HE, hostname);
                if (IM && *IM)

-                       putf(IM, ptyibuf+1, p);
+                       putf(IM, ptyibuf+1);

        } else {
                sprintf(ptyibuf+1, BANNER, hostname);
        }
        } else {
                sprintf(ptyibuf+1, BANNER, hostname);
        }


@@ -1374,10 +1381,9 @@ putchr(cc)
        *putlocation++ = cc;
 }
 
        *putlocation++ = cc;
 }
 

-putf(cp, where, tty)
+putf(cp, where)

 register char *cp;
 char *where;
 register char *cp;
 char *where;

-int tty;

 {
        char *slash;
        char datebuffer[60];
 {
        char *slash;
        char datebuffer[60];