src/cons.saver.c

   1 /* This program should be setuid vcsa and /dev/vcsa* should be
   2    owned by the same user too.
   3    Partly rewritten by Jakub Jelinek <jakub@redhat.com>.  */
   4
   5 /* General purpose Linux console screen save/restore server
   6    Copyright (C) 1994, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
   7    2006, 2007 Free Software Foundation, Inc.
   8    Original idea from Unix Interactive Tools version 3.2b (tty.c)
   9    This code requires root privileges.
  10    You may want to make the cons.saver setuid root.
  11    The code should be safe even if it is setuid but who knows?
  12
  13    This program is free software; you can redistribute it and/or modify
  14    it under the terms of the GNU General Public License as published by
  15    the Free Software Foundation; either version 2 of the License, or
  16    (at your option) any later version.
  17
  18    This program is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21    GNU General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with this program; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  26
  27 /* This code does _not_ need to be setuid root. However, it needs
  28    read/write access to /dev/vcsa* (which is priviledged
  29    operation). You should create user vcsa, make cons.saver setuid
  30    user vcsa, and make all vcsa's owned by user vcsa.
  31
  32    Seeing other peoples consoles is bad thing, but believe me, full
  33    root is even worse. */
  34
  35 #ifdef HAVE_CONFIG_H
  36 #include <config.h>
  37 #endif
  38
  39 #ifndef _GNU_SOURCE
  40 #define _GNU_SOURCE
  41 #endif
  42
  43 #include <stdlib.h>
  44 #include <stdio.h>
  45 #include <string.h>
  46
  47 #include <sys/types.h>
  48 #include <sys/stat.h>
  49 #include <sys/ioctl.h>
  50 #include <fcntl.h>
  51 #ifdef HAVE_TERMIOS_H
  52 #include <termios.h>
  53 #endif
  54 #include <unistd.h>
  55
  56 #define LINUX_CONS_SAVER_C
  57 #include "cons.saver.h"
  58
  59 static void
  60 send_contents (char *buffer, unsigned int columns, unsigned int rows)
  61 {
  62   unsigned char begin_line = 0, end_line = 0;
  63   unsigned int lastline, index, x;
  64   unsigned char message, outbuf[1024], *p;
  65   unsigned short bytes;
  66
  67   index = 2 * rows * columns;
  68   for (lastline = rows; lastline > 0; lastline--)
  69     for (x = 0; x < columns; x++)
  70       {
  71         index -= 2;
  72         if (buffer [index] != ' ')
  73           goto out;
  74       }
  75 out:
  76
  77   message = CONSOLE_CONTENTS;
  78   write (1, &message, 1);
  79
  80   read (0, &begin_line, 1);
  81   read (0, &end_line, 1);
  82   if (begin_line > lastline)
  83     begin_line = lastline;
  84   if (end_line > lastline)
  85     end_line = lastline;
  86
  87   index = (end_line - begin_line) * columns;
  88   bytes = index;
  89   if (index != bytes)
  90     bytes = 0;
  91   write (1, &bytes, 2);
  92   if (! bytes)
  93     return;
  94
  95   p = outbuf;
  96   for (index = 2 * begin_line * columns;
  97        index < 2 * end_line * columns;
  98        index += 2)
  99     {
 100       *p++ = buffer [index];
 101       if (p == outbuf + sizeof (outbuf))
 102         {
 103           write (1, outbuf, sizeof (outbuf));
 104           p = outbuf;
 105         }
 106     }
 107
 108   if (p != outbuf)
 109     write (1, outbuf, p - outbuf);
 110 }
 111
 112 static void __attribute__ ((noreturn))
 113 die (void)
 114 {
 115   unsigned char zero = 0;
 116   write (1, &zero, 1);
 117   exit (3);
 118 }
 119
 120 int
 121 main (int argc, char **argv)
 122 {
 123   unsigned char action = 0, console_flag = 3;
 124   int console_fd, vcsa_fd, console_minor, buffer_size;
 125   struct stat st;
 126   uid_t uid, euid;
 127   char *buffer, *tty_name, console_name [16], vcsa_name [16], *p, *q;
 128   struct winsize winsz;
 129
 130   close (2);
 131
 132   if (argc != 2)
 133     die ();
 134
 135   tty_name = argv [1];
 136   if (strnlen (tty_name, 15) == 15
 137       || strncmp (tty_name, "/dev/", 5))
 138     die ();
 139
 140   setsid ();
 141   uid = getuid ();
 142   euid = geteuid ();
 143
 144   if (seteuid (uid) < 0)
 145     die ();
 146   console_fd = open (tty_name, O_RDONLY);
 147   if (console_fd < 0)
 148     die ();
 149   if (fstat (console_fd, &st) < 0 || ! S_ISCHR (st.st_mode))
 150     die ();
 151   if ((st.st_rdev & 0xff00) != 0x0400)
 152     die ();
 153   console_minor = (int) (st.st_rdev & 0x00ff);
 154   if (console_minor < 1 || console_minor > 63)
 155     die ();
 156   if (st.st_uid != uid)
 157     die ();
 158
 159   switch (tty_name [5])
 160     {
 161     /* devfs */
 162     case 'v': p = "/dev/vc/%d"; q = "/dev/vcc/a%d"; break;
 163     /* /dev/ttyN */
 164     case 't': p = "/dev/tty%d"; q = "/dev/vcsa%d"; break;
 165     default: die (); break;
 166     }
 167
 168   snprintf (console_name, sizeof (console_name), p, console_minor);
 169   if (strncmp (console_name, tty_name, sizeof (console_name)) != 0)
 170     die ();
 171
 172   if (seteuid (euid) < 0)
 173     die ();
 174
 175   snprintf (vcsa_name, sizeof (vcsa_name), q, console_minor);
 176   vcsa_fd = open (vcsa_name, O_RDWR);
 177   if (vcsa_fd < 0)
 178     die ();
 179   if (fstat (vcsa_fd, &st) < 0 || ! S_ISCHR (st.st_mode))
 180     die ();
 181
 182   if (seteuid (uid) < 0)
 183     die ();
 184
 185   winsz.ws_col = winsz.ws_row = 0;
 186   if (ioctl (console_fd, TIOCGWINSZ, &winsz) < 0
 187       || winsz.ws_col <= 0 || winsz.ws_row <= 0
 188       || winsz.ws_col >= 256 || winsz.ws_row >= 256)
 189     die ();
 190
 191   buffer_size = 4 + 2 * winsz.ws_col * winsz.ws_row;
 192   buffer = calloc (buffer_size, 1);
 193   if (buffer == NULL)
 194     die ();
 195
 196   write (1, &console_flag, 1);
 197
 198   while (console_flag && read (0, &action, 1) == 1)
 199     {
 200       switch (action)
 201         {
 202         case CONSOLE_DONE:
 203           console_flag = 0;
 204           continue;
 205         case CONSOLE_SAVE:
 206           if (seteuid (euid) < 0
 207               || lseek (vcsa_fd, 0, 0) != 0
 208               || fstat (console_fd, &st) < 0 || st.st_uid != uid
 209               || read (vcsa_fd, buffer, buffer_size) != buffer_size
 210               || fstat (console_fd, &st) < 0 || st.st_uid != uid)
 211             memset (buffer, 0, buffer_size);
 212           if (seteuid (uid) < 0)
 213             die ();
 214           break;
 215         case CONSOLE_RESTORE:
 216           if (seteuid (euid) >= 0
 217               && lseek (vcsa_fd, 0, 0) == 0
 218               && fstat (console_fd, &st) >= 0 && st.st_uid == uid)
 219             write (vcsa_fd, buffer, buffer_size);
 220           if (seteuid (uid) < 0)
 221             die ();
 222           break;
 223         case CONSOLE_CONTENTS:
 224           send_contents (buffer + 4, winsz.ws_col, winsz.ws_row);
 225           break;
 226         }
 227
 228       write (1, &console_flag, 1);
 229     }
 230
 231   exit (0);
 232 }