src/cons.saver.c

   1 /* This program should be setuid vcsa and /dev/vcsa* should be
   2    owned by the same user too.
   3    Partly rewritten by Jakub Jelinek <jakub@redhat.com>.  */
   4
   5 /* General purpose Linux console screen save/restore server
   6    Copyright (C) 1994 Janne Kukonlehto <jtklehto@stekt.oulu.fi>
   7    Original idea from Unix Interactive Tools version 3.2b (tty.c)
   8    This code requires root privileges.
   9    You may want to make the cons.saver setuid root.
  10    The code should be safe even if it is setuid but who knows?
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 2 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program; if not, write to the Free Software
  24    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  25
  26 /* This code does _not_ need to be setuid root. However, it needs
  27    read/write access to /dev/vcsa* (which is priviledged
  28    operation). You should create user vcsa, make cons.saver setuid
  29    user vcsa, and make all vcsa's owned by user vcsa.
  30
  31    Seeing other peoples consoles is bad thing, but believe me, full
  32    root is even worse. */
  33
  34 #ifndef _GNU_SOURCE
  35 #define _GNU_SOURCE
  36 #endif
  37
  38 #include <stdlib.h>
  39 #include <stdio.h>
  40 #include <string.h>
  41
  42 #include <sys/types.h>
  43 #include <sys/stat.h>
  44 #include <sys/ioctl.h>
  45 #include <fcntl.h>
  46 #ifdef HAVE_TERMIOS_H
  47 #include <termios.h>
  48 #endif
  49 #include <unistd.h>
  50
  51 #define LINUX_CONS_SAVER_C
  52 #include "cons.saver.h"
  53
  54 static void
  55 send_contents (char *buffer, unsigned int columns, unsigned int rows)
  56 {
  57   unsigned char begin_line = 0, end_line = 0;
  58   unsigned int lastline, index, x;
  59   unsigned char message, outbuf[1024], *p;
  60   unsigned short bytes;
  61
  62   index = 2 * rows * columns;
  63   for (lastline = rows; lastline > 0; lastline--)
  64     for (x = 0; x < columns; x++)
  65       {
  66         index -= 2;
  67         if (buffer [index] != ' ')
  68           goto out;
  69       }
  70 out:
  71
  72   message = CONSOLE_CONTENTS;
  73   write (1, &message, 1);
  74
  75   read (0, &begin_line, 1);
  76   read (0, &end_line, 1);
  77   if (begin_line > lastline)
  78     begin_line = lastline;
  79   if (end_line > lastline)
  80     end_line = lastline;
  81
  82   index = (end_line - begin_line) * columns;
  83   bytes = index;
  84   if (index != bytes)
  85     bytes = 0;
  86   write (1, &bytes, 2);
  87   if (! bytes)
  88     return;
  89
  90   p = outbuf;
  91   for (index = 2 * begin_line * columns;
  92        index < 2 * end_line * columns;
  93        index += 2)
  94     {
  95       *p++ = buffer [index];
  96       if (p == outbuf + sizeof (outbuf))
  97         {
  98           write (1, outbuf, sizeof (outbuf));
  99           p = outbuf;
 100         }
 101     }
 102
 103   if (p != outbuf)
 104     write (1, outbuf, p - outbuf);
 105 }
 106
 107 static void __attribute__ ((noreturn))
 108 die (void)
 109 {
 110   unsigned char zero = 0;
 111   write (1, &zero, 1);
 112   exit (3);
 113 }
 114
 115 int
 116 main (int argc, char **argv)
 117 {
 118   unsigned char action = 0, console_flag = 3;
 119   int console_fd, vcsa_fd, console_minor, buffer_size;
 120   struct stat st;
 121   uid_t uid, euid;
 122   char *buffer, *tty_name, console_name [16], vcsa_name [16], *p, *q;
 123   struct winsize winsz;
 124
 125   close (2);
 126
 127   if (argc != 2)
 128     die ();
 129
 130   tty_name = argv [1];
 131   if (strnlen (tty_name, 15) == 15
 132       || strncmp (tty_name, "/dev/", 5))
 133     die ();
 134
 135   setsid ();
 136   uid = getuid ();
 137   euid = geteuid ();
 138
 139   if (seteuid (uid) < 0)
 140     die ();
 141   console_fd = open (tty_name, O_RDONLY);
 142   if (console_fd < 0)
 143     die ();
 144   if (fstat (console_fd, &st) < 0 || ! S_ISCHR (st.st_mode))
 145     die ();
 146   if ((st.st_rdev & 0xff00) != 0x0400)
 147     die ();
 148   console_minor = (int) (st.st_rdev & 0x00ff);
 149   if (console_minor < 1 || console_minor > 63)
 150     die ();
 151   if (st.st_uid != uid)
 152     die ();
 153
 154   switch (tty_name [5])
 155     {
 156     /* devfs */
 157     case 'v': p = "/dev/vc/%d"; q = "/dev/vcc/a%d"; break;
 158     /* /dev/ttyN */
 159     case 't': p = "/dev/tty%d"; q = "/dev/vcsa%d"; break;
 160     default: die (); break;
 161     }
 162
 163   snprintf (console_name, sizeof (console_name), p, console_minor);
 164   if (strncmp (console_name, tty_name, sizeof (console_name)) != 0)
 165     die ();
 166
 167   if (seteuid (euid) < 0)
 168     die ();
 169
 170   snprintf (vcsa_name, sizeof (vcsa_name), q, console_minor);
 171   vcsa_fd = open (vcsa_name, O_RDWR);
 172   if (vcsa_fd < 0)
 173     die ();
 174   if (fstat (vcsa_fd, &st) < 0 || ! S_ISCHR (st.st_mode))
 175     die ();
 176
 177   if (seteuid (uid) < 0)
 178     die ();
 179
 180   winsz.ws_col = winsz.ws_row = 0;
 181   if (ioctl (console_fd, TIOCGWINSZ, &winsz) < 0
 182       || winsz.ws_col <= 0 || winsz.ws_row <= 0
 183       || winsz.ws_col >= 256 || winsz.ws_row >= 256)
 184     die ();
 185
 186   buffer_size = 4 + 2 * winsz.ws_col * winsz.ws_row;
 187   buffer = calloc (buffer_size, 1);
 188   if (buffer == NULL)
 189     die ();
 190
 191   write (1, &console_flag, 1);
 192
 193   while (console_flag && read (0, &action, 1) == 1)
 194     {
 195       switch (action)
 196         {
 197         case CONSOLE_DONE:
 198           console_flag = 0;
 199           continue;
 200         case CONSOLE_SAVE:
 201           if (seteuid (euid) < 0
 202               || lseek (vcsa_fd, 0, 0) != 0
 203               || fstat (console_fd, &st) < 0 || st.st_uid != uid
 204               || read (vcsa_fd, buffer, buffer_size) != buffer_size
 205               || fstat (console_fd, &st) < 0 || st.st_uid != uid)
 206             memset (buffer, 0, buffer_size);
 207           if (seteuid (uid) < 0)
 208             die ();
 209           break;
 210         case CONSOLE_RESTORE:
 211           if (seteuid (euid) >= 0
 212               && lseek (vcsa_fd, 0, 0) == 0
 213               && fstat (console_fd, &st) >= 0 && st.st_uid == uid)
 214             write (vcsa_fd, buffer, buffer_size);
 215           if (seteuid (uid) < 0)
 216             die ();
 217           break;
 218         case CONSOLE_CONTENTS:
 219           send_contents (buffer + 4, winsz.ws_col, winsz.ws_row);
 220           break;
 221         }
 222
 223       write (1, &console_flag, 1);
 224     }
 225
 226   exit (0);
 227 }