ex/ex_init.c

   1 /*-
   2  * Copyright (c) 1992, 1993, 1994
   3  *      The Regents of the University of California.  All rights reserved.
   4  * Copyright (c) 1992, 1993, 1994, 1995, 1996
   5  *      Keith Bostic.  All rights reserved.
   6  *
   7  * See the LICENSE file for redistribution information.
   8  */
   9
  10 #include "config.h"
  11
  12 #ifndef lint
  13 static const char sccsid[] = "$Id: ex_init.c,v 10.31 2001/06/25 15:19:16 skimo Exp $ (Berkeley) $Date: 2001/06/25 15:19:16 $";
  14 #endif /* not lint */
  15
  16 #include <sys/param.h>
  17 #include <sys/types.h>          /* XXX: param.h may not have included types.h */
  18 #include <sys/queue.h>
  19 #include <sys/stat.h>
  20
  21 #include <bitstring.h>
  22 #include <fcntl.h>
  23 #include <limits.h>
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <unistd.h>
  28
  29 #include "../common/common.h"
  30 #include "tag.h"
  31 #include "pathnames.h"
  32
  33 enum rc { NOEXIST, NOPERM, RCOK };
  34 static enum rc  exrc_isok __P((SCR *, struct stat *, char *, int, int));
  35
  36 static int ex_run_file __P((SCR *, char *));
  37
  38 /*
  39  * ex_screen_copy --
  40  *      Copy ex screen.
  41  *
  42  * PUBLIC: int ex_screen_copy __P((SCR *, SCR *));
  43  */
  44 int
  45 ex_screen_copy(SCR *orig, SCR *sp)
  46 {
  47         EX_PRIVATE *oexp, *nexp;
  48
  49         /* Create the private ex structure. */
  50         CALLOC_RET(orig, nexp, EX_PRIVATE *, 1, sizeof(EX_PRIVATE));
  51         sp->ex_private = nexp;
  52
  53         /* Initialize queues. */
  54         CIRCLEQ_INIT(&nexp->tq);
  55         TAILQ_INIT(&nexp->tagfq);
  56         LIST_INIT(&nexp->cscq);
  57
  58         if (orig == NULL) {
  59         } else {
  60                 oexp = EXP(orig);
  61
  62                 if (oexp->lastbcomm != NULL &&
  63                     (nexp->lastbcomm = v_wstrdup(sp, oexp->lastbcomm,
  64                                      STRLEN(oexp->lastbcomm))) == NULL) {
  65                         msgq(sp, M_SYSERR, NULL);
  66                         return(1);
  67                 }
  68                 if (ex_tag_copy(orig, sp))
  69                         return (1);
  70         }
  71         return (0);
  72 }
  73
  74 /*
  75  * ex_screen_end --
  76  *      End a vi screen.
  77  *
  78  * PUBLIC: int ex_screen_end __P((SCR *));
  79  */
  80 int
  81 ex_screen_end(SCR *sp)
  82 {
  83         EX_PRIVATE *exp;
  84         int rval;
  85
  86         if ((exp = EXP(sp)) == NULL)
  87                 return (0);
  88
  89         rval = 0;
  90
  91         /* Close down script connections. */
  92         if (F_ISSET(sp, SC_SCRIPT) && sscr_end(sp))
  93                 rval = 1;
  94
  95         if (argv_free(sp))
  96                 rval = 1;
  97
  98         if (exp->ibp != NULL)
  99                 free(exp->ibp);
 100
 101         if (exp->lastbcomm != NULL)
 102                 free(exp->lastbcomm);
 103
 104         if (ex_tag_free(sp))
 105                 rval = 1;
 106
 107         /* Free private memory. */
 108         free(exp);
 109         sp->ex_private = NULL;
 110
 111         return (rval);
 112 }
 113
 114 /*
 115  * ex_optchange --
 116  *      Handle change of options for ex.
 117  *
 118  * PUBLIC: int ex_optchange __P((SCR *, int, char *, u_long *));
 119  */
 120 int
 121 ex_optchange(SCR *sp, int offset, char *str, u_long *valp)
 122 {
 123         switch (offset) {
 124         case O_TAGS:
 125                 return (ex_tagf_alloc(sp, str));
 126         }
 127         return (0);
 128 }
 129
 130 /*
 131  * ex_exrc --
 132  *      Read the EXINIT environment variable and the startup exrc files,
 133  *      and execute their commands.
 134  *
 135  * PUBLIC: int ex_exrc __P((SCR *));
 136  */
 137 int
 138 ex_exrc(SCR *sp)
 139 {
 140         struct stat hsb, lsb;
 141         char *p, path[MAXPATHLEN];
 142         CHAR_T *wp;
 143         size_t wlen;
 144
 145         /*
 146          * Source the system, environment, $HOME and local .exrc values.
 147          * Vi historically didn't check $HOME/.exrc if the environment
 148          * variable EXINIT was set.  This is all done before the file is
 149          * read in, because things in the .exrc information can set, for
 150          * example, the recovery directory.
 151          *
 152          * !!!
 153          * While nvi can handle any of the options settings of historic vi,
 154          * the converse is not true.  Since users are going to have to have
 155          * files and environmental variables that work with both, we use nvi
 156          * versions of both the $HOME and local startup files if they exist,
 157          * otherwise the historic ones.
 158          *
 159          * !!!
 160          * For a discussion of permissions and when what .exrc files are
 161          * read, see the comment above the exrc_isok() function below.
 162          *
 163          * !!!
 164          * If the user started the historic of vi in $HOME, vi read the user's
 165          * .exrc file twice, as $HOME/.exrc and as ./.exrc.  We avoid this, as
 166          * it's going to make some commands behave oddly, and I can't imagine
 167          * anyone depending on it.
 168          */
 169         switch (exrc_isok(sp, &hsb, _PATH_SYSEXRC, 1, 0)) {
 170         case NOEXIST:
 171         case NOPERM:
 172                 break;
 173         case RCOK:
 174                 if (ex_run_file(sp, _PATH_SYSEXRC))
 175                         return (1);
 176                 break;
 177         }
 178
 179         /* Run the commands. */
 180         if (EXCMD_RUNNING(sp->wp))
 181                 (void)ex_cmd(sp);
 182         if (F_ISSET(sp, SC_EXIT | SC_EXIT_FORCE))
 183                 return (0);
 184
 185         if ((p = getenv("NEXINIT")) != NULL) {
 186                 CHAR2INT(sp, p, strlen(p) + 1, wp, wlen);
 187                 if (ex_run_str(sp, "NEXINIT", wp, wlen - 1, 1, 0))
 188                         return (1);
 189         } else if ((p = getenv("EXINIT")) != NULL) {
 190                 CHAR2INT(sp, p, strlen(p) + 1, wp, wlen);
 191                 if (ex_run_str(sp, "EXINIT", wp, wlen - 1, 1, 0))
 192                         return (1);
 193         } else if ((p = getenv("HOME")) != NULL && *p) {
 194                 (void)snprintf(path, sizeof(path), "%s/%s", p, _PATH_NEXRC);
 195                 switch (exrc_isok(sp, &hsb, path, 0, 1)) {
 196                 case NOEXIST:
 197                         (void)snprintf(path,
 198                             sizeof(path), "%s/%s", p, _PATH_EXRC);
 199                         if (exrc_isok(sp,
 200                             &hsb, path, 0, 1) == RCOK && ex_run_file(sp, path))
 201                                 return (1);
 202                         break;
 203                 case NOPERM:
 204                         break;
 205                 case RCOK:
 206                         if (ex_run_file(sp, path))
 207                                 return (1);
 208                         break;
 209                 }
 210         }
 211
 212         /* Run the commands. */
 213         if (EXCMD_RUNNING(sp->wp))
 214                 (void)ex_cmd(sp);
 215         if (F_ISSET(sp, SC_EXIT | SC_EXIT_FORCE))
 216                 return (0);
 217
 218         /* Previous commands may have set the exrc option. */
 219         if (O_ISSET(sp, O_EXRC)) {
 220                 switch (exrc_isok(sp, &lsb, _PATH_NEXRC, 0, 0)) {
 221                 case NOEXIST:
 222                         if (exrc_isok(sp, &lsb, _PATH_EXRC, 0, 0) == RCOK &&
 223                             (lsb.st_dev != hsb.st_dev ||
 224                             lsb.st_ino != hsb.st_ino) &&
 225                             ex_run_file(sp, _PATH_EXRC))
 226                                 return (1);
 227                         break;
 228                 case NOPERM:
 229                         break;
 230                 case RCOK:
 231                         if ((lsb.st_dev != hsb.st_dev ||
 232                             lsb.st_ino != hsb.st_ino) &&
 233                             ex_run_file(sp, _PATH_NEXRC))
 234                                 return (1);
 235                         break;
 236                 }
 237                 /* Run the commands. */
 238                 if (EXCMD_RUNNING(sp->wp))
 239                         (void)ex_cmd(sp);
 240                 if (F_ISSET(sp, SC_EXIT | SC_EXIT_FORCE))
 241                         return (0);
 242         }
 243
 244         return (0);
 245 }
 246
 247 /*
 248  * ex_run_file --
 249  *      Set up a file of ex commands to run.
 250  */
 251 static int
 252 ex_run_file(SCR *sp, char *name)
 253 {
 254         EXCMD cmd;
 255         CHAR_T *wp;
 256         size_t wlen;
 257
 258         ex_cinit(sp, &cmd, C_SOURCE, 0, OOBLNO, OOBLNO, 0);
 259         CHAR2INT(sp, name, strlen(name)+1, wp, wlen);
 260         argv_exp0(sp, &cmd, wp, wlen - 1);
 261         return (ex_source(sp, &cmd));
 262 }
 263
 264 /*
 265  * ex_run_str --
 266  *      Set up a string of ex commands to run.
 267  *
 268  * PUBLIC: int ex_run_str __P((SCR *, char *, CHAR_T *, size_t, int, int));
 269  */
 270 int
 271 ex_run_str(SCR *sp, char *name, CHAR_T *str, size_t len, int ex_flags, int nocopy)
 272 {
 273         WIN *wp;
 274         EXCMD *ecp;
 275
 276         wp = sp->wp;
 277         if (EXCMD_RUNNING(wp)) {
 278                 CALLOC_RET(sp, ecp, EXCMD *, 1, sizeof(EXCMD));
 279                 LIST_INSERT_HEAD(&wp->ecq, ecp, q);
 280         } else
 281                 ecp = &wp->excmd;
 282
 283         F_INIT(ecp,
 284             ex_flags ? E_BLIGNORE | E_NOAUTO | E_NOPRDEF | E_VLITONLY : 0);
 285
 286         if (nocopy)
 287                 ecp->cp = str;
 288         else
 289                 if ((ecp->cp = v_wstrdup(sp, str, len)) == NULL)
 290                         return (1);
 291         ecp->clen = len;
 292
 293         if (name == NULL)
 294                 ecp->if_name = NULL;
 295         else {
 296                 if ((ecp->if_name = v_strdup(sp, name, strlen(name))) == NULL)
 297                         return (1);
 298                 ecp->if_lno = 1;
 299                 F_SET(ecp, E_NAMEDISCARD);
 300         }
 301
 302         return (0);
 303 }
 304
 305 /*
 306  * exrc_isok --
 307  *      Check a .exrc file for source-ability.
 308  *
 309  * !!!
 310  * Historically, vi read the $HOME and local .exrc files if they were owned
 311  * by the user's real ID, or the "sourceany" option was set, regardless of
 312  * any other considerations.  We no longer support the sourceany option as
 313  * it's a security problem of mammoth proportions.  We require the system
 314  * .exrc file to be owned by root, the $HOME .exrc file to be owned by the
 315  * user's effective ID (or that the user's effective ID be root) and the
 316  * local .exrc files to be owned by the user's effective ID.  In all cases,
 317  * the file cannot be writeable by anyone other than its owner.
 318  *
 319  * In O'Reilly ("Learning the VI Editor", Fifth Ed., May 1992, page 106),
 320  * it notes that System V release 3.2 and later has an option "[no]exrc".
 321  * The behavior is that local .exrc files are read only if the exrc option
 322  * is set.  The default for the exrc option was off, so, by default, local
 323  * .exrc files were not read.  The problem this was intended to solve was
 324  * that System V permitted users to give away files, so there's no possible
 325  * ownership or writeability test to ensure that the file is safe.
 326  *
 327  * POSIX 1003.2-1992 standardized exrc as an option.  It required the exrc
 328  * option to be off by default, thus local .exrc files are not to be read
 329  * by default.  The Rationale noted (incorrectly) that this was a change
 330  * to historic practice, but correctly noted that a default of off improves
 331  * system security.  POSIX also required that vi check the effective user
 332  * ID instead of the real user ID, which is why we've switched from historic
 333  * practice.
 334  *
 335  * We initialize the exrc variable to off.  If it's turned on by the system
 336  * or $HOME .exrc files, and the local .exrc file passes the ownership and
 337  * writeability tests, then we read it.  This breaks historic 4BSD practice,
 338  * but it gives us a measure of security on systems where users can give away
 339  * files.
 340  */
 341 static enum rc
 342 exrc_isok(SCR *sp, struct stat *sbp, char *path, int rootown, int rootid)
 343 {
 344         enum { ROOTOWN, OWN, WRITER } etype;
 345         uid_t euid;
 346         int nf1, nf2;
 347         char *a, *b, buf[MAXPATHLEN];
 348
 349         /* Check for the file's existence. */
 350         if (stat(path, sbp))
 351                 return (NOEXIST);
 352
 353         /* Check ownership permissions. */
 354         euid = geteuid();
 355         if (!(rootown && sbp->st_uid == 0) &&
 356             !(rootid && euid == 0) && sbp->st_uid != euid) {
 357                 etype = rootown ? ROOTOWN : OWN;
 358                 goto denied;
 359         }
 360
 361         /* Check writeability. */
 362         if (sbp->st_mode & (S_IWGRP | S_IWOTH)) {
 363                 etype = WRITER;
 364                 goto denied;
 365         }
 366         return (RCOK);
 367
 368 denied: a = msg_print(sp, path, &nf1);
 369         if (strchr(path, '/') == NULL && getcwd(buf, sizeof(buf)) != NULL) {
 370                 b = msg_print(sp, buf, &nf2);
 371                 switch (etype) {
 372                 case ROOTOWN:
 373                         msgq(sp, M_ERR,
 374                             "125|%s/%s: not sourced: not owned by you or root",
 375                             b, a);
 376                         break;
 377                 case OWN:
 378                         msgq(sp, M_ERR,
 379                             "126|%s/%s: not sourced: not owned by you", b, a);
 380                         break;
 381                 case WRITER:
 382                         msgq(sp, M_ERR,
 383     "127|%s/%s: not sourced: writeable by a user other than the owner", b, a);
 384                         break;
 385                 }
 386                 if (nf2)
 387                         FREE_SPACE(sp, b, 0);
 388         } else
 389                 switch (etype) {
 390                 case ROOTOWN:
 391                         msgq(sp, M_ERR,
 392                             "128|%s: not sourced: not owned by you or root", a);
 393                         break;
 394                 case OWN:
 395                         msgq(sp, M_ERR,
 396                             "129|%s: not sourced: not owned by you", a);
 397                         break;
 398                 case WRITER:
 399                         msgq(sp, M_ERR,
 400             "130|%s: not sourced: writeable by a user other than the owner", a);
 401                         break;
 402                 }
 403
 404         if (nf1)
 405                 FREE_SPACE(sp, a, 0);
 406         return (NOPERM);
 407 }