summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/Makefile40
-rw-r--r--src/admin-wrapper.c95
-rw-r--r--src/admindb-wrapper.c94
-rw-r--r--src/archives-wrapper.c95
-rw-r--r--src/cgi-wrapper.c75
-rw-r--r--src/edithtml-wrapper.c95
-rw-r--r--src/handle_opts-wrapper.c99
-rw-r--r--src/listinfo-wrapper.c96
-rw-r--r--src/options-wrapper.c95
-rw-r--r--src/roster-wrapper.c107
-rw-r--r--src/subscribe-wrapper.c106
11 files changed, 96 insertions, 901 deletions
diff --git a/src/Makefile b/src/Makefile
index bce93a3e8..cefb19ce8 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -1,43 +1,45 @@
HOME=/home/mailman
-MAILMAN=/home/mailman/mailman
+CGI=${HOME}/cgi-bin
+MAILMAN=${HOME}/mailman
+
all: admin_wrapper admindb_wrapper archives_wrapper edithtml_wrapper options_wrapper listinfo_wrapper subscribe_wrapper roster_wrapper handle_opts_wrapper mail_wrapper alias_wrapper
admin_wrapper:
- gcc -o ${HOME}/cgi-bin/admin admin-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/admin
+ gcc -D SCRIPT="\"admin\"" -o ${CGI}/admin cgi-wrapper.c
+ chmod a+sx ${CGI}/admin
admindb_wrapper:
- gcc -o ${HOME}/cgi-bin/admindb admindb-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/admindb
+ gcc -D SCRIPT="\"admindb\"" -o ${CGI}/admindb cgi-wrapper.c
+ chmod a+sx ${CGI}/admindb
archives_wrapper:
- gcc -o ${HOME}/cgi-bin/archives archives-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/archives
+ gcc -D SCRIPT="\"archives\"" -o ${CGI}/archives cgi-wrapper.c
+ chmod a+sx ${CGI}/archives
edithtml_wrapper:
- gcc -o ${HOME}/cgi-bin/edithtml edithtml-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/edithtml
+ gcc -D SCRIPT="\"edithtml\"" -o ${CGI}/edithtml cgi-wrapper.c
+ chmod a+sx ${CGI}/edithtml
options_wrapper:
- gcc -o ${HOME}/cgi-bin/options options-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/options
+ gcc -D SCRIPT="\"options\"" -o ${CGI}/options cgi-wrapper.c
+ chmod a+sx ${CGI}/options
listinfo_wrapper:
- gcc -o ${HOME}/cgi-bin/listinfo listinfo-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/listinfo
+ gcc -D SCRIPT="\"listinfo\"" -o ${CGI}/listinfo cgi-wrapper.c
+ chmod a+sx ${CGI}/listinfo
subscribe_wrapper:
- gcc -o ${HOME}/cgi-bin/subscribe subscribe-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/subscribe
+ gcc -D SCRIPT="\"subscribe\"" -o ${CGI}/subscribe cgi-wrapper.c
+ chmod a+sx ${CGI}/subscribe
roster_wrapper:
- gcc -o ${HOME}/cgi-bin/roster roster-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/roster
+ gcc -D SCRIPT="\"roster\"" -o ${CGI}/roster cgi-wrapper.c
+ chmod a+sx ${CGI}/roster
handle_opts_wrapper:
- gcc -o ${HOME}/cgi-bin/handle_opts handle_opts-wrapper.c
- chmod a+sx ${HOME}/cgi-bin/handle_opts
+ gcc -D SCRIPT="\"handle_opts\"" -o ${CGI}/handle_opts cgi-wrapper.c
+ chmod a+sx ${CGI}/handle_opts
mail_wrapper:
gcc -o ${MAILMAN}/mail/wrapper mail-wrapper.c
diff --git a/src/admin-wrapper.c b/src/admin-wrapper.c
deleted file mode 100644
index df495da58..000000000
--- a/src/admin-wrapper.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/admin";
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- printf("GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- printf("GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- setuid(geteuid());
- execve(COMMAND, &argv[0], env);
- }
- else {
- printf("Illegal caller!\n");
- }
-}
-
diff --git a/src/admindb-wrapper.c b/src/admindb-wrapper.c
deleted file mode 100644
index 748d78812..000000000
--- a/src/admindb-wrapper.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/admindb";
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- printf("GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- printf("GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- setuid(geteuid());
- execve(COMMAND, &argv[0], env);
- }
- else {
- printf("Illegal caller!\n");
- }
-}
diff --git a/src/archives-wrapper.c b/src/archives-wrapper.c
deleted file mode 100644
index 89a23934b..000000000
--- a/src/archives-wrapper.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/archives";
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- printf("GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- printf("GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- setuid(geteuid());
- execve(COMMAND, &argv[0], env);
- }
- else {
- printf("Illegal caller!\n");
- }
-}
-
diff --git a/src/cgi-wrapper.c b/src/cgi-wrapper.c
new file mode 100644
index 000000000..b54bc8ff0
--- /dev/null
+++ b/src/cgi-wrapper.c
@@ -0,0 +1,75 @@
+/*
+** generic wrapper that will take info from a environment
+** variable, and pass it to two commands.
+**
+** 10-17-96 : Hal Schechner
+** 12-14-96 : John Viega -- changed to work on 1 command,
+** take a list of valid commands,
+** just pass on argv, and use execvp()
+** Also threw in some useful feedback for when there's
+** a failure, mainly for future debugging.
+**
+** 03-31-98 : John Viega -- Consolidated all CGI wrappers into 1,
+** removed checking the command name, (it was
+** not real security anyway...) and changed it to use
+** syslog on error. This definitely doesn't have any of
+** Hal's code left ;-)
+**
+*/
+#include <stdio.h>
+#include <stdarg.h>
+#include <syslog.h>
+
+#define COMMAND "/home/mailman/mailman/cgi/" ## SCRIPT
+#define LOG_IDENT "Mailman-wrapper (" ## SCRIPT ## ")"
+
+const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
+const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
+
+/*
+** Report an error then exit.
+*/
+void err(char *format, ...)
+{
+ char log_entry[1024];
+
+ va_list arg_ptr;
+ va_start(arg_ptr, format);
+ vsprintf(log_entry, format, arg_ptr);
+ va_end(arg_ptr);
+
+ // Write to the console, maillog is often mostly ignored,
+ // and root should definitely know about any problems.
+ openlog(LOG_IDENT, LOG_CONS, LOG_MAIL);
+ syslog(LOG_ERR, "%s", log_entry);
+ closelog();
+ exit(0);
+}
+
+/*
+** is the parent process allowed to call us?
+*/
+void check_caller() {
+ /* compare to our parent's uid */
+ if(LEGAL_PARENT_UID != getuid())
+ {
+ err("Attempt to exec cgi %s made by uid %d", LEGAL_PARENT_UID,
+ getuid());
+ }
+ if(LEGAL_PARENT_GID != getgid())
+ {
+ err("Attempt to exec cgi %s made by gid %d", LEGAL_PARENT_GID,
+ getgid());
+ }
+}
+
+void main(int argc, char **argv, char **env)
+{
+ int i;
+
+ check_caller();
+ // If we get here, the caller is OK.
+ setuid(geteuid());
+ execve(COMMAND, &argv[0], env);
+ err("execve of %s failed!", COMMAND);
+}
diff --git a/src/edithtml-wrapper.c b/src/edithtml-wrapper.c
deleted file mode 100644
index 08a08ecfa..000000000
--- a/src/edithtml-wrapper.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/edithtml";
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- printf("GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- printf("GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- setuid(geteuid());
- execve(COMMAND, &argv[0], env);
- }
- else {
- printf("Illegal caller!\n");
- }
-}
-
diff --git a/src/handle_opts-wrapper.c b/src/handle_opts-wrapper.c
deleted file mode 100644
index bb3800a36..000000000
--- a/src/handle_opts-wrapper.c
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/handle_opts";
-
-FILE *f;
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- fprintf(f,"GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- fprintf(f,"GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
-
- f = fopen("/tmp/zozo", "w+");
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- setuid(geteuid());
- execve(COMMAND, &argv[0], env);
- }
- else {
- fprintf(f,"Illegal caller!\n");
- }
-}
-
diff --git a/src/listinfo-wrapper.c b/src/listinfo-wrapper.c
deleted file mode 100644
index fd42fe131..000000000
--- a/src/listinfo-wrapper.c
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/listinfo";
-
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- printf("GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- printf("GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- argv[0] = (char *)COMMAND;
- execve(COMMAND, argv, env);
- }
- else {
- printf("Illegal caller!\n");
- }
-}
-
diff --git a/src/options-wrapper.c b/src/options-wrapper.c
deleted file mode 100644
index 3a87dfd4c..000000000
--- a/src/options-wrapper.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/options";
-
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- printf("GOT UID %d.\n", getuid());
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- printf("GOT GID %d.\n", getgid());
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- if(legal_caller()) {
- execve(COMMAND, &argv[0], env);
- }
- else {
- printf("Illegal caller!\n");
- }
-}
-
diff --git a/src/roster-wrapper.c b/src/roster-wrapper.c
deleted file mode 100644
index 201b81982..000000000
--- a/src/roster-wrapper.c
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-** 03-30-98 : klm - roster-wrapper copied precisely from subscribe-wrapper.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/roster";
-FILE *f;
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- fprintf(f,"GOT UID %d.\n", getuid());
- fflush(f);
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- fprintf(f,"GOT GID %d.\n", getgid());
- fflush(f);
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- f = fopen("/tmp/wtf_man","w+");
- fprintf(f, "Hello...\n");
- fflush(f);
- if(legal_caller()) {
- setuid(geteuid());
- fprintf(f, "Sheesh...\n");
- fflush(f);
- execve(COMMAND, &argv[0], env);
- fprintf(f, "Damn, I suck.\n");
- fflush(f);
- }
- else {
- fprintf(f,"Illegal caller!\n");
- fflush(f);
- }
-}
-
diff --git a/src/subscribe-wrapper.c b/src/subscribe-wrapper.c
deleted file mode 100644
index bd1fc1582..000000000
--- a/src/subscribe-wrapper.c
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
-** generic wrapper that will take info from a environment
-** variable, and pass it to two commands.
-**
-** 10-17-96 : Hal Schechner
-** 12-14-96 : John Viega -- changed to work on 1 command,
-** take a list of valid commands,
-** just pass on argv, and use execvp()
-** Also threw in some useful feedback for when there's
-** a failure, mainly for future debugging.
-**
-** Chmod this bitch 4755.
-**
-*/
-#include <stdio.h>
-
-const char *COMMAND = "/home/mailman/mailman/cgi/subscribe";
-FILE *f;
-
-/* Might want to make this full path.
- I can write whatever program named sendmail,
- so this isn't much for security.
-*/
-const char *LEGAL_PARENT_NAMES[] = {
- "httpd",
- NULL /* Sentinal, don't remove */
-};
-
-/* Should make these arrays too... */
-const int LEGAL_PARENT_UID = 60001; /* nobody's UID */
-const int LEGAL_PARENT_GID = 60001; /* nobody's GID */
-
-
-/*
-** what is the name of the process with pid of 'pid'
-*/
-char *get_process_name(int pid) {
- FILE *proc;
- char fname[30];
- char tmp[255];
- static char procname[255];
- sprintf(fname, "/proc/%d/status", pid);
- proc = fopen(fname, "r");
- fgets(tmp, 256, proc);
- sscanf(tmp, "Name: %s\n", procname);
- fclose(proc);
- return procname;
-}
-
-
-int valid_parent(char *parent){
- int i = 0;
-
- while(LEGAL_PARENT_NAMES[i] != NULL)
- {
- if(!strcmp(parent, LEGAL_PARENT_NAMES[i]))
- {
- return 1;
- }
- i++;
- }
- return 0;
-}
-
-/*
-** is the parent process allowed to call us?
-*/
-int legal_caller() {
- /* compare to our parent's uid */
- if(LEGAL_PARENT_UID != getuid())
- {
- fprintf(f,"GOT UID %d.\n", getuid());
- fflush(f);
- return 0;
- }
- if(LEGAL_PARENT_GID != getgid())
- {
- fprintf(f,"GOT GID %d.\n", getgid());
- fflush(f);
- return 0;
- }
- return 1;
-}
-
-void main(int argc, char **argv, char **env) {
- char *command;
- int i;
- command = (char *)malloc(sizeof(char) * i);
-
- f = fopen("/tmp/wtf_man","w+");
- fprintf(f, "Hello...\n");
- fflush(f);
- if(legal_caller()) {
- setuid(geteuid());
- fprintf(f, "Sheesh...\n");
- fflush(f);
- execve(COMMAND, &argv[0], env);
- fprintf(f, "Damn, I suck.\n");
- fflush(f);
- }
- else {
- fprintf(f,"Illegal caller!\n");
- fflush(f);
- }
-}
-
generated by cgit v1.2.3-70-g09d2 (git 2.51.2) at 2025-11-09 01:47:14 +0000