summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjvoisin2022-07-12 23:03:46 +0200
committerjvoisin2022-07-12 23:03:46 +0200
commit8d6496efcab420267a228c35f9f627fec209d031 (patch)
treec7d29977b14dedbc4b4d7c571381ca6df667fda6
parent08e87202676a4676e66a27625522374faa70704c (diff)
Refactoring of the previous commit
-rw-r--r--src/php_snuffleupagus.h1
-rw-r--r--src/sp_execute.c20
-rw-r--r--src/tests/deny_writable/deny_writable_execution_simulation.phpt4
3 files changed, 10 insertions, 15 deletions
diff --git a/src/php_snuffleupagus.h b/src/php_snuffleupagus.h
index 95caa65..3eeb9db 100644
--- a/src/php_snuffleupagus.h
+++ b/src/php_snuffleupagus.h
@@ -38,6 +38,7 @@
38#include "ext/standard/head.h" 38#include "ext/standard/head.h"
39#include "ext/standard/info.h" 39#include "ext/standard/info.h"
40#include "ext/standard/url.h" 40#include "ext/standard/url.h"
41#include "ext/standard/php_string.h"
41#include "ext/standard/php_var.h" 42#include "ext/standard/php_var.h"
42#include "ext/session/php_session.h" 43#include "ext/session/php_session.h"
43#include "php.h" 44#include "php.h"
diff --git a/src/sp_execute.c b/src/sp_execute.c
index 56d25c5..65a32db 100644
--- a/src/sp_execute.c
+++ b/src/sp_execute.c
@@ -1,5 +1,4 @@
1#include "php_snuffleupagus.h" 1#include "php_snuffleupagus.h"
2#include "ext/standard/php_string.h"
3 2
4static void (*orig_execute_ex)(zend_execute_data *execute_data) = NULL; 3static void (*orig_execute_ex)(zend_execute_data *execute_data) = NULL;
5static void (*orig_zend_execute_internal)(zend_execute_data *execute_data, 4static void (*orig_zend_execute_internal)(zend_execute_data *execute_data,
@@ -11,11 +10,10 @@ static zend_result (*orig_zend_stream_open)(zend_file_handle *handle) = NULL;
11#endif 10#endif
12 11
13// FIXME handle symlink 12// FIXME handle symlink
14ZEND_COLD static inline void terminate_if_writable(const char *filename) { 13ZEND_COLD static inline void terminate_if_writable(char const* const filename) {
15 const sp_config_readonly_exec *config_ro_exec = &(SPCFG(readonly_exec)); 14 sp_config_readonly_exec const* const config_ro_exec = &(SPCFG(readonly_exec));
16 char *errmsg = "unknown access problem"; 15 char const *errmsg = "unknown access problem";
17 16
18 // check write access
19 if (0 == access(filename, W_OK)) { 17 if (0 == access(filename, W_OK)) {
20 errmsg = "Attempted execution of a writable file"; 18 errmsg = "Attempted execution of a writable file";
21 goto violation; 19 goto violation;
@@ -29,21 +27,19 @@ ZEND_COLD static inline void terminate_if_writable(const char *filename) {
29 return; 27 return;
30 } 28 }
31 29
32 // check effective uid
33 struct stat buf; 30 struct stat buf;
34 if (0 != stat(filename, &buf)) { 31 if (0 != stat(filename, &buf)) {
35 goto err; 32 goto err;
36 } 33 }
37 if (buf.st_uid == geteuid()) { 34 if (buf.st_uid == geteuid()) {
38 errmsg = "Attempted execution of file owned by process"; 35 errmsg = "Attempted execution of a file owned by the PHP process";
39 goto violation; 36 goto violation;
40 } 37 }
41 38
42 // check write access on directory 39 char *const dirname = estrndup(filename, strlen(filename));
43 char *dirname = estrndup(filename, strlen(filename));
44 php_dirname(dirname, strlen(dirname)); 40 php_dirname(dirname, strlen(dirname));
45 if (0 == access(dirname, W_OK)) { 41 if (0 == access(dirname, W_OK)) {
46 errmsg = "Attempted execution of file in writable directory"; 42 errmsg = "Attempted execution of a file in a writable directory";
47 efree(dirname); 43 efree(dirname);
48 goto violation; 44 goto violation;
49 } 45 }
@@ -52,18 +48,16 @@ ZEND_COLD static inline void terminate_if_writable(const char *filename) {
52 goto err; 48 goto err;
53 } 49 }
54 50
55 // check effecite uid of directory
56 if (0 != stat(dirname, &buf)) { 51 if (0 != stat(dirname, &buf)) {
57 efree(dirname); 52 efree(dirname);
58 goto err; 53 goto err;
59 } 54 }
60 efree(dirname); 55 efree(dirname);
61 if (buf.st_uid == geteuid()) { 56 if (buf.st_uid == geteuid()) {
62 errmsg = "Attempted execution of file in directory owned by process"; 57 errmsg = "Attempted execution of a file in directory owned by the PHP process";
63 goto violation; 58 goto violation;
64 } 59 }
65 60
66 // we would actually need to check all parent directories as well, but that task is left for other tools
67 return; 61 return;
68 62
69violation: 63violation:
diff --git a/src/tests/deny_writable/deny_writable_execution_simulation.phpt b/src/tests/deny_writable/deny_writable_execution_simulation.phpt
index abc276f..d4e4801 100644
--- a/src/tests/deny_writable/deny_writable_execution_simulation.phpt
+++ b/src/tests/deny_writable/deny_writable_execution_simulation.phpt
@@ -48,7 +48,7 @@ Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution
48Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of a writable file (%a/writable_file.txt) in %a/writable_file.txt on line 1 48Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of a writable file (%a/writable_file.txt) in %a/writable_file.txt on line 1
49Code execution within a writable file. 49Code execution within a writable file.
50 50
51Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of file owned by process (%s/tests/deny_writable/non_writable_file.txt) in %s/tests/deny_writable/deny_writable_execution_simulation.php on line 13 51Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of a file owned by the PHP process (%s/tests/deny_writable/non_writable_file.txt) in %s/tests/deny_writable/deny_writable_execution_simulation.php on line 13
52 52
53Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of file owned by process (%s/tests/deny_writable/non_writable_file.txt) in %src/tests/deny_writable/non_writable_file.txt on line 1 53Warning: [snuffleupagus][0.0.0.0][readonly_exec][simulation] Attempted execution of a file owned by the PHP process (%s/tests/deny_writable/non_writable_file.txt) in %src/tests/deny_writable/non_writable_file.txt on line 1
54Code execution within a non-writable file. 54Code execution within a non-writable file.