src/consaver/cons.saver.c

   1 /* This program should be setuid vcsa and /dev/vcsa* should be
   2    owned by the same user too.
   3    Partly rewritten by Jakub Jelinek <jakub@redhat.com>.  */
   4
   5 /* General purpose Linux console screen save/restore server
   6    Copyright (C) 1994, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
   7    2006, 2007 Free Software Foundation, Inc.
   8    Original idea from Unix Interactive Tools version 3.2b (tty.c)
   9    This code requires root privileges.
  10    You may want to make the cons.saver setuid root.
  11    The code should be safe even if it is setuid but who knows?
  12
  13    This program is free software; you can redistribute it and/or modify
  14    it under the terms of the GNU General Public License as published by
  15    the Free Software Foundation; either version 2 of the License, or
  16    (at your option) any later version.
  17
  18    This program is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21    GNU General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with this program; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  26
  27 /* This code does _not_ need to be setuid root. However, it needs
  28    read/write access to /dev/vcsa* (which is priviledged
  29    operation). You should create user vcsa, make cons.saver setuid
  30    user vcsa, and make all vcsa's owned by user vcsa.
  31
  32    Seeing other peoples consoles is bad thing, but believe me, full
  33    root is even worse. */
  34
  35 /** \file cons.saver.c
  36  *  \brief Source: general purpose Linux console screen save/restore server
  37  *
  38  *  This code does _not_ need to be setuid root. However, it needs
  39  *  read/write access to /dev/vcsa* (which is priviledged
  40  *  operation). You should create user vcsa, make cons.saver setuid
  41  *  user vcsa, and make all vcsa's owned by user vcsa.
  42  *  Seeing other peoples consoles is bad thing, but believe me, full
  43  *  root is even worse.
  44  */
  45
  46 #include <config.h>
  47
  48 #ifndef _GNU_SOURCE
  49 #define _GNU_SOURCE
  50 #endif
  51
  52 #include <stdlib.h>
  53 #include <stdio.h>
  54 #include <string.h>
  55
  56 #include <sys/types.h>
  57 #include <sys/stat.h>
  58 #include <sys/ioctl.h>
  59 #include <fcntl.h>
  60 #include <termios.h>
  61 #include <unistd.h>
  62
  63 #define LINUX_CONS_SAVER_C
  64 #include "cons.saver.h"
  65
  66 static void
  67 send_contents (char *buffer, unsigned int columns, unsigned int rows)
  68 {
  69     unsigned char begin_line = 0, end_line = 0;
  70     unsigned int lastline, lc_index, x;
  71     unsigned char message, outbuf[1024], *p;
  72     unsigned short bytes;
  73
  74     lc_index = 2 * rows * columns;
  75     for (lastline = rows; lastline > 0; lastline--)
  76         for (x = 0; x < columns; x++)
  77         {
  78             lc_index -= 2;
  79             if (buffer[lc_index] != ' ')
  80                 goto out;
  81         }
  82   out:
  83
  84     message = CONSOLE_CONTENTS;
  85     if (write (1, &message, 1) != 1)
  86         return;
  87     if (read (0, &begin_line, 1) != 1)
  88         return;
  89     if (read (0, &end_line, 1) != 1)
  90         return;
  91     if (begin_line > lastline)
  92         begin_line = lastline;
  93     if (end_line > lastline)
  94         end_line = lastline;
  95
  96     lc_index = (end_line - begin_line) * columns;
  97     bytes = lc_index;
  98
  99     if (write (1, &bytes, 2) != 2)
 100         return;
 101     if (bytes == 0)
 102         return;
 103
 104     p = outbuf;
 105     for (lc_index = 2 * begin_line * columns; lc_index < 2 * end_line * columns; lc_index += 2)
 106     {
 107         *p++ = buffer[lc_index];
 108         if (p == outbuf + sizeof (outbuf))
 109         {
 110             if (write (1, outbuf, sizeof (outbuf)) != sizeof (outbuf))
 111                 return;
 112             p = outbuf;
 113         }
 114     }
 115
 116     if (p != outbuf)
 117         if (write (1, outbuf, p - outbuf) < (p - outbuf))
 118             return;
 119 }
 120
 121 static void __attribute__ ((noreturn)) die (void)
 122 {
 123     unsigned char zero = 0;
 124     ssize_t ret;
 125     ret = write (1, &zero, 1);
 126     exit (3);
 127 }
 128
 129 int
 130 main (int argc, char **argv)
 131 {
 132     unsigned char action = 0, console_flag = 3;
 133     int console_fd, vcsa_fd, console_minor, buffer_size;
 134     struct stat st;
 135     uid_t uid, euid;
 136     char *buffer, *tty_name, console_name[16], vcsa_name[16];
 137     const char *p, *q;
 138     struct winsize winsz;
 139
 140     close (2);
 141
 142     if (argc != 2)
 143         die ();
 144
 145     tty_name = argv[1];
 146     if (strnlen (tty_name, 15) == 15 || strncmp (tty_name, "/dev/", 5))
 147         die ();
 148
 149     setsid ();
 150     uid = getuid ();
 151     euid = geteuid ();
 152
 153     if (seteuid (uid) < 0)
 154         die ();
 155     console_fd = open (tty_name, O_RDONLY);
 156     if (console_fd < 0)
 157         die ();
 158     if (fstat (console_fd, &st) < 0 || !S_ISCHR (st.st_mode))
 159         die ();
 160     if ((st.st_rdev & 0xff00) != 0x0400)
 161         die ();
 162     console_minor = (int) (st.st_rdev & 0x00ff);
 163     if (console_minor < 1 || console_minor > 63)
 164         die ();
 165     if (st.st_uid != uid)
 166         die ();
 167
 168     switch (tty_name[5])
 169     {
 170         /* devfs */
 171     case 'v':
 172         p = "/dev/vc/%d";
 173         q = "/dev/vcc/a%d";
 174         break;
 175         /* /dev/ttyN */
 176     case 't':
 177         p = "/dev/tty%d";
 178         q = "/dev/vcsa%d";
 179         break;
 180     default:
 181         die ();
 182         break;
 183     }
 184
 185     snprintf (console_name, sizeof (console_name), p, console_minor);
 186     if (strncmp (console_name, tty_name, sizeof (console_name)) != 0)
 187         die ();
 188
 189     if (seteuid (euid) < 0)
 190         die ();
 191
 192     snprintf (vcsa_name, sizeof (vcsa_name), q, console_minor);
 193     vcsa_fd = open (vcsa_name, O_RDWR);
 194     if (vcsa_fd < 0)
 195         die ();
 196     if (fstat (vcsa_fd, &st) < 0 || !S_ISCHR (st.st_mode))
 197         die ();
 198
 199     if (seteuid (uid) < 0)
 200         die ();
 201
 202     winsz.ws_col = winsz.ws_row = 0;
 203     if (ioctl (console_fd, TIOCGWINSZ, &winsz) < 0
 204         || winsz.ws_col <= 0 || winsz.ws_row <= 0 || winsz.ws_col >= 256 || winsz.ws_row >= 256)
 205         die ();
 206
 207     buffer_size = 4 + 2 * winsz.ws_col * winsz.ws_row;
 208     buffer = calloc (buffer_size, 1);
 209     if (buffer == NULL)
 210         die ();
 211
 212     if (write (1, &console_flag, 1) != 1)
 213         die ();
 214
 215     while (console_flag && read (0, &action, 1) == 1)
 216     {
 217         switch (action)
 218         {
 219         case CONSOLE_DONE:
 220             console_flag = 0;
 221             continue;
 222         case CONSOLE_SAVE:
 223             if (seteuid (euid) < 0
 224                 || lseek (vcsa_fd, 0, 0) != 0
 225                 || fstat (console_fd, &st) < 0 || st.st_uid != uid
 226                 || read (vcsa_fd, buffer, buffer_size) != buffer_size
 227                 || fstat (console_fd, &st) < 0 || st.st_uid != uid)
 228                 memset (buffer, 0, buffer_size);
 229             if (seteuid (uid) < 0)
 230                 die ();
 231             break;
 232         case CONSOLE_RESTORE:
 233             if (seteuid (euid) >= 0
 234                 && lseek (vcsa_fd, 0, 0) == 0 && fstat (console_fd, &st) >= 0 && st.st_uid == uid)
 235                 if (write (vcsa_fd, buffer, buffer_size) != buffer_size)
 236                     die ();
 237             if (seteuid (uid) < 0)
 238                 die ();
 239             break;
 240         case CONSOLE_CONTENTS:
 241             send_contents (buffer + 4, winsz.ws_col, winsz.ws_row);
 242             break;
 243         }
 244
 245         if (write (1, &console_flag, 1) != 1)
 246             die ();
 247     }
 248
 249     exit (0);
 250 }