src/cons.saver.c

   1 /* This program should be setuid vcsa and /dev/vcsa* should be
   2    owned by the same user too.
   3    Partly rewritten by Jakub Jelinek <jakub@redhat.com>.  */
   4
   5 /* General purpose Linux console screen save/restore server
   6    Copyright (C) 1994, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
   7    2006, 2007 Free Software Foundation, Inc.
   8    Original idea from Unix Interactive Tools version 3.2b (tty.c)
   9    This code requires root privileges.
  10    You may want to make the cons.saver setuid root.
  11    The code should be safe even if it is setuid but who knows?
  12
  13    This program is free software; you can redistribute it and/or modify
  14    it under the terms of the GNU General Public License as published by
  15    the Free Software Foundation; either version 2 of the License, or
  16    (at your option) any later version.
  17
  18    This program is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21    GNU General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with this program; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  26
  27 /* This code does _not_ need to be setuid root. However, it needs
  28    read/write access to /dev/vcsa* (which is priviledged
  29    operation). You should create user vcsa, make cons.saver setuid
  30    user vcsa, and make all vcsa's owned by user vcsa.
  31
  32    Seeing other peoples consoles is bad thing, but believe me, full
  33    root is even worse. */
  34
  35 #ifdef HAVE_CONFIG_H
  36 #include <config.h>
  37 #endif
  38
  39 #ifndef _GNU_SOURCE
  40 #define _GNU_SOURCE
  41 #endif
  42
  43 #include <stdlib.h>
  44 #include <stdio.h>
  45 #include <string.h>
  46
  47 #include <sys/types.h>
  48 #include <sys/stat.h>
  49 #include <sys/ioctl.h>
  50 #include <fcntl.h>
  51 #ifdef HAVE_TERMIOS_H
  52 #include <termios.h>
  53 #endif
  54 #include <unistd.h>
  55
  56 #include <mhl/string.h>
  57
  58 #define LINUX_CONS_SAVER_C
  59 #include "cons.saver.h"
  60
  61 static void
  62 send_contents (char *buffer, unsigned int columns, unsigned int rows)
  63 {
  64   unsigned char begin_line = 0, end_line = 0;
  65   unsigned int lastline, index, x;
  66   unsigned char message, outbuf[1024], *p;
  67   unsigned short bytes;
  68
  69   index = 2 * rows * columns;
  70   for (lastline = rows; lastline > 0; lastline--)
  71     for (x = 0; x < columns; x++)
  72       {
  73         index -= 2;
  74         if (buffer [index] != ' ')
  75           goto out;
  76       }
  77 out:
  78
  79   message = CONSOLE_CONTENTS;
  80   write (1, &message, 1);
  81
  82   read (0, &begin_line, 1);
  83   read (0, &end_line, 1);
  84   if (begin_line > lastline)
  85     begin_line = lastline;
  86   if (end_line > lastline)
  87     end_line = lastline;
  88
  89   index = (end_line - begin_line) * columns;
  90   bytes = index;
  91   if (index != bytes)
  92     bytes = 0;
  93   write (1, &bytes, 2);
  94   if (! bytes)
  95     return;
  96
  97   p = outbuf;
  98   for (index = 2 * begin_line * columns;
  99        index < 2 * end_line * columns;
 100        index += 2)
 101     {
 102       *p++ = buffer [index];
 103       if (p == outbuf + sizeof (outbuf))
 104         {
 105           write (1, outbuf, sizeof (outbuf));
 106           p = outbuf;
 107         }
 108     }
 109
 110   if (p != outbuf)
 111     write (1, outbuf, p - outbuf);
 112 }
 113
 114 static void __attribute__ ((noreturn))
 115 die (void)
 116 {
 117   unsigned char zero = 0;
 118   write (1, &zero, 1);
 119   exit (3);
 120 }
 121
 122 int
 123 main (int argc, char **argv)
 124 {
 125   unsigned char action = 0, console_flag = 3;
 126   int console_fd, vcsa_fd, console_minor, buffer_size;
 127   struct stat st;
 128   uid_t uid, euid;
 129   char *buffer, *tty_name, console_name [16], vcsa_name [16], *p, *q;
 130   struct winsize winsz;
 131
 132   close (2);
 133
 134   if (argc != 2)
 135     die ();
 136
 137   tty_name = argv [1];
 138   if (strnlen (tty_name, 15) == 15
 139       || strncmp (tty_name, "/dev/", 5))
 140     die ();
 141
 142   setsid ();
 143   uid = getuid ();
 144   euid = geteuid ();
 145
 146   if (seteuid (uid) < 0)
 147     die ();
 148   console_fd = open (tty_name, O_RDONLY);
 149   if (console_fd < 0)
 150     die ();
 151   if (fstat (console_fd, &st) < 0 || ! S_ISCHR (st.st_mode))
 152     die ();
 153   if ((st.st_rdev & 0xff00) != 0x0400)
 154     die ();
 155   console_minor = (int) (st.st_rdev & 0x00ff);
 156   if (console_minor < 1 || console_minor > 63)
 157     die ();
 158   if (st.st_uid != uid)
 159     die ();
 160
 161   switch (tty_name [5])
 162     {
 163     /* devfs */
 164     case 'v': p = "/dev/vc/%d"; q = "/dev/vcc/a%d"; break;
 165     /* /dev/ttyN */
 166     case 't': p = "/dev/tty%d"; q = "/dev/vcsa%d"; break;
 167     default: die (); break;
 168     }
 169
 170   snprintf (console_name, sizeof (console_name), p, console_minor);
 171   if (strncmp (console_name, tty_name, sizeof (console_name)) != 0)
 172     die ();
 173
 174   if (seteuid (euid) < 0)
 175     die ();
 176
 177   snprintf (vcsa_name, sizeof (vcsa_name), q, console_minor);
 178   vcsa_fd = open (vcsa_name, O_RDWR);
 179   if (vcsa_fd < 0)
 180     die ();
 181   if (fstat (vcsa_fd, &st) < 0 || ! S_ISCHR (st.st_mode))
 182     die ();
 183
 184   if (seteuid (uid) < 0)
 185     die ();
 186
 187   winsz.ws_col = winsz.ws_row = 0;
 188   if (ioctl (console_fd, TIOCGWINSZ, &winsz) < 0
 189       || winsz.ws_col <= 0 || winsz.ws_row <= 0
 190       || winsz.ws_col >= 256 || winsz.ws_row >= 256)
 191     die ();
 192
 193   buffer_size = 4 + 2 * winsz.ws_col * winsz.ws_row;
 194   buffer = calloc (buffer_size, 1);
 195   if (buffer == NULL)
 196     die ();
 197
 198   write (1, &console_flag, 1);
 199
 200   while (console_flag && read (0, &action, 1) == 1)
 201     {
 202       switch (action)
 203         {
 204         case CONSOLE_DONE:
 205           console_flag = 0;
 206           continue;
 207         case CONSOLE_SAVE:
 208           if (seteuid (euid) < 0
 209               || lseek (vcsa_fd, 0, 0) != 0
 210               || fstat (console_fd, &st) < 0 || st.st_uid != uid
 211               || read (vcsa_fd, buffer, buffer_size) != buffer_size
 212               || fstat (console_fd, &st) < 0 || st.st_uid != uid)
 213             memset (buffer, 0, buffer_size);
 214           if (seteuid (uid) < 0)
 215             die ();
 216           break;
 217         case CONSOLE_RESTORE:
 218           if (seteuid (euid) >= 0
 219               && lseek (vcsa_fd, 0, 0) == 0
 220               && fstat (console_fd, &st) >= 0 && st.st_uid == uid)
 221             write (vcsa_fd, buffer, buffer_size);
 222           if (seteuid (uid) < 0)
 223             die ();
 224           break;
 225         case CONSOLE_CONTENTS:
 226           send_contents (buffer + 4, winsz.ws_col, winsz.ws_row);
 227           break;
 228         }
 229
 230       write (1, &console_flag, 1);
 231     }
 232
 233   exit (0);
 234 }