src/consaver/cons.saver.c

   1 /* This program should be setuid vcsa and /dev/vcsa* should be
   2    owned by the same user too.
   3    Partly rewritten by Jakub Jelinek <jakub@redhat.com>.  */
   4
   5 /* General purpose Linux console screen save/restore server
   6    Copyright (C) 1994, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
   7    2006, 2007 Free Software Foundation, Inc.
   8    Original idea from Unix Interactive Tools version 3.2b (tty.c)
   9    This code requires root privileges.
  10    You may want to make the cons.saver setuid root.
  11    The code should be safe even if it is setuid but who knows?
  12
  13    This program is free software; you can redistribute it and/or modify
  14    it under the terms of the GNU General Public License as published by
  15    the Free Software Foundation; either version 2 of the License, or
  16    (at your option) any later version.
  17
  18    This program is distributed in the hope that it will be useful,
  19    but WITHOUT ANY WARRANTY; without even the implied warranty of
  20    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21    GNU General Public License for more details.
  22
  23    You should have received a copy of the GNU General Public License
  24    along with this program; if not, write to the Free Software
  25    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  26
  27 /* This code does _not_ need to be setuid root. However, it needs
  28    read/write access to /dev/vcsa* (which is priviledged
  29    operation). You should create user vcsa, make cons.saver setuid
  30    user vcsa, and make all vcsa's owned by user vcsa.
  31
  32    Seeing other peoples consoles is bad thing, but believe me, full
  33    root is even worse. */
  34
  35 /** \file cons.saver.c
  36  *  \brief Source: general purpose Linux console screen save/restore server
  37  *
  38  *  This code does _not_ need to be setuid root. However, it needs
  39  *  read/write access to /dev/vcsa* (which is priviledged
  40  *  operation). You should create user vcsa, make cons.saver setuid
  41  *  user vcsa, and make all vcsa's owned by user vcsa.
  42  *  Seeing other peoples consoles is bad thing, but believe me, full
  43  *  root is even worse.
  44  */
  45
  46 #include <config.h>
  47
  48 #ifndef _GNU_SOURCE
  49 #define _GNU_SOURCE
  50 #endif
  51
  52 #include <stdlib.h>
  53 #include <stdio.h>
  54 #include <string.h>
  55
  56 #include <sys/types.h>
  57 #include <sys/stat.h>
  58 #ifdef HAVE_SYS_IOCTL_H
  59 #include <sys/ioctl.h>
  60 #endif
  61 #include <fcntl.h>
  62 #include <termios.h>
  63 #include <unistd.h>
  64
  65 #define LINUX_CONS_SAVER_C
  66 #include "cons.saver.h"
  67
  68 /*** global variables ****************************************************************************/
  69
  70 /*** file scope macro definitions ****************************************************************/
  71
  72 /*** file scope type declarations ****************************************************************/
  73
  74 /*** file scope variables ************************************************************************/
  75
  76 /*** file scope functions ************************************************************************/
  77 /* --------------------------------------------------------------------------------------------- */
  78
  79 static void
  80 send_contents (char *buffer, unsigned int columns, unsigned int rows)
  81 {
  82     unsigned char begin_line = 0, end_line = 0;
  83     unsigned int lastline, lc_index, x;
  84     unsigned char message, outbuf[1024], *p;
  85     unsigned short bytes;
  86
  87     lc_index = 2 * rows * columns;
  88     for (lastline = rows; lastline > 0; lastline--)
  89         for (x = 0; x < columns; x++)
  90         {
  91             lc_index -= 2;
  92             if (buffer[lc_index] != ' ')
  93                 goto out;
  94         }
  95   out:
  96
  97     message = CONSOLE_CONTENTS;
  98     if (write (1, &message, 1) != 1)
  99         return;
 100     if (read (0, &begin_line, 1) != 1)
 101         return;
 102     if (read (0, &end_line, 1) != 1)
 103         return;
 104     if (begin_line > lastline)
 105         begin_line = lastline;
 106     if (end_line > lastline)
 107         end_line = lastline;
 108
 109     lc_index = (end_line - begin_line) * columns;
 110     bytes = lc_index;
 111
 112     if (write (1, &bytes, 2) != 2)
 113         return;
 114     if (bytes == 0)
 115         return;
 116
 117     p = outbuf;
 118     for (lc_index = 2 * begin_line * columns; lc_index < 2 * end_line * columns; lc_index += 2)
 119     {
 120         *p++ = buffer[lc_index];
 121         if (p == outbuf + sizeof (outbuf))
 122         {
 123             if (write (1, outbuf, sizeof (outbuf)) != sizeof (outbuf))
 124                 return;
 125             p = outbuf;
 126         }
 127     }
 128
 129     if (p != outbuf)
 130         if (write (1, outbuf, p - outbuf) < (p - outbuf))
 131             return;
 132 }
 133
 134 /* --------------------------------------------------------------------------------------------- */
 135
 136 static void __attribute__ ((noreturn)) die (void)
 137 {
 138     unsigned char zero = 0;
 139     ssize_t ret;
 140     ret = write (1, &zero, 1);
 141     exit (3);
 142 }
 143
 144 /* --------------------------------------------------------------------------------------------- */
 145 /*** public functions ****************************************************************************/
 146 /* --------------------------------------------------------------------------------------------- */
 147
 148 int
 149 main (int argc, char **argv)
 150 {
 151     unsigned char action = 0, console_flag = 3;
 152     int console_fd, vcsa_fd, console_minor, buffer_size;
 153     struct stat st;
 154     uid_t uid, euid;
 155     char *buffer, *tty_name, console_name[16], vcsa_name[16];
 156     const char *p, *q;
 157     struct winsize winsz;
 158
 159     close (2);
 160
 161     if (argc != 2)
 162         die ();
 163
 164     tty_name = argv[1];
 165     if (strnlen (tty_name, 15) == 15 || strncmp (tty_name, "/dev/", 5))
 166         die ();
 167
 168     setsid ();
 169     uid = getuid ();
 170     euid = geteuid ();
 171
 172     if (seteuid (uid) < 0)
 173         die ();
 174     console_fd = open (tty_name, O_RDONLY);
 175     if (console_fd < 0)
 176         die ();
 177     if (fstat (console_fd, &st) < 0 || !S_ISCHR (st.st_mode))
 178         die ();
 179     if ((st.st_rdev & 0xff00) != 0x0400)
 180         die ();
 181     console_minor = (int) (st.st_rdev & 0x00ff);
 182     if (console_minor < 1 || console_minor > 63)
 183         die ();
 184     if (st.st_uid != uid)
 185         die ();
 186
 187     switch (tty_name[5])
 188     {
 189         /* devfs */
 190     case 'v':
 191         p = "/dev/vc/%d";
 192         q = "/dev/vcc/a%d";
 193         break;
 194         /* /dev/ttyN */
 195     case 't':
 196         p = "/dev/tty%d";
 197         q = "/dev/vcsa%d";
 198         break;
 199     default:
 200         die ();
 201         break;
 202     }
 203
 204     snprintf (console_name, sizeof (console_name), p, console_minor);
 205     if (strncmp (console_name, tty_name, sizeof (console_name)) != 0)
 206         die ();
 207
 208     if (seteuid (euid) < 0)
 209         die ();
 210
 211     snprintf (vcsa_name, sizeof (vcsa_name), q, console_minor);
 212     vcsa_fd = open (vcsa_name, O_RDWR);
 213     if (vcsa_fd < 0)
 214         die ();
 215     if (fstat (vcsa_fd, &st) < 0 || !S_ISCHR (st.st_mode))
 216         die ();
 217
 218     if (seteuid (uid) < 0)
 219         die ();
 220
 221     winsz.ws_col = winsz.ws_row = 0;
 222     if (ioctl (console_fd, TIOCGWINSZ, &winsz) < 0
 223         || winsz.ws_col <= 0 || winsz.ws_row <= 0 || winsz.ws_col >= 256 || winsz.ws_row >= 256)
 224         die ();
 225
 226     buffer_size = 4 + 2 * winsz.ws_col * winsz.ws_row;
 227     buffer = calloc (buffer_size, 1);
 228     if (buffer == NULL)
 229         die ();
 230
 231     if (write (1, &console_flag, 1) != 1)
 232         die ();
 233
 234     while (console_flag && read (0, &action, 1) == 1)
 235     {
 236         switch (action)
 237         {
 238         case CONSOLE_DONE:
 239             console_flag = 0;
 240             continue;
 241         case CONSOLE_SAVE:
 242             if (seteuid (euid) < 0
 243                 || lseek (vcsa_fd, 0, 0) != 0
 244                 || fstat (console_fd, &st) < 0 || st.st_uid != uid
 245                 || read (vcsa_fd, buffer, buffer_size) != buffer_size
 246                 || fstat (console_fd, &st) < 0 || st.st_uid != uid)
 247                 memset (buffer, 0, buffer_size);
 248             if (seteuid (uid) < 0)
 249                 die ();
 250             break;
 251         case CONSOLE_RESTORE:
 252             if (seteuid (euid) >= 0
 253                 && lseek (vcsa_fd, 0, 0) == 0 && fstat (console_fd, &st) >= 0 && st.st_uid == uid)
 254                 if (write (vcsa_fd, buffer, buffer_size) != buffer_size)
 255                     die ();
 256             if (seteuid (uid) < 0)
 257                 die ();
 258             break;
 259         case CONSOLE_CONTENTS:
 260             send_contents (buffer + 4, winsz.ws_col, winsz.ws_row);
 261             break;
 262         }
 263
 264         if (write (1, &console_flag, 1) != 1)
 265             die ();
 266     }
 267
 268     exit (0);
 269 }
 270
 271 /* --------------------------------------------------------------------------------------------- */