From 2ca174000e9be4878321c08920e7abfc76b89d88 Mon Sep 17 00:00:00 2001 From: TitanSnow Date: Mon, 22 May 2017 14:52:58 +0800 Subject: add setuid feature to os.uid --- xmake/core/base/os.lua | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'xmake/core/base/os.lua') diff --git a/xmake/core/base/os.lua b/xmake/core/base/os.lua index 02d96ad7e..0bae655b7 100644 --- a/xmake/core/base/os.lua +++ b/xmake/core/base/os.lua @@ -627,17 +627,11 @@ function os.nuldev() end -- get uid -function os.uid() - - -- get it from cache first - if os._UID then - return os._UID - end - +function os.uid(...) -- get uid os._UID = {} if os._uid then - os._UID = os._uid() or {} + os._UID = os._uid(...) or {} end -- ok? -- cgit v1.3.1 From d4aab4ff42e4032f848e0c6f048aaa61cb7db18b Mon Sep 17 00:00:00 2001 From: TitanSnow Date: Mon, 22 May 2017 15:22:16 +0800 Subject: add os.gid() --- core/src/xmake/machine.c | 2 + core/src/xmake/makefile | 1 + core/src/xmake/os/gid.c | 155 +++++++++++++++++++++++++++++++++++++++++++++++ xmake/core/base/os.lua | 13 ++++ 4 files changed, 171 insertions(+) create mode 100644 core/src/xmake/os/gid.c (limited to 'xmake/core/base/os.lua') diff --git a/core/src/xmake/machine.c b/core/src/xmake/machine.c index 753ff579d..a1ae497ec 100644 --- a/core/src/xmake/machine.c +++ b/core/src/xmake/machine.c @@ -83,6 +83,7 @@ tb_int_t xm_os_getwinsize(lua_State* lua); tb_int_t xm_os_versioninfo(lua_State* lua); #ifndef TB_CONFIG_OS_WINDOWS tb_int_t xm_os_uid(lua_State* lua); +tb_int_t xm_os_gid(lua_State* lua); #endif // the path functions @@ -146,6 +147,7 @@ static luaL_Reg const g_os_functions[] = , { "versioninfo", xm_os_versioninfo} #ifndef TB_CONFIG_OS_WINDOWS , { "uid", xm_os_uid } +, { "gid", xm_os_gid } #endif , { tb_null, tb_null } }; diff --git a/core/src/xmake/makefile b/core/src/xmake/makefile index b1b29ed83..f2be6405d 100644 --- a/core/src/xmake/makefile +++ b/core/src/xmake/makefile @@ -38,6 +38,7 @@ xmake_C_FILES += \ os/getwinsize \ os/versioninfo \ os/uid \ + os/gid \ path/relative \ path/absolute \ path/translate \ diff --git a/core/src/xmake/os/gid.c b/core/src/xmake/os/gid.c new file mode 100644 index 000000000..03a8c0e13 --- /dev/null +++ b/core/src/xmake/os/gid.c @@ -0,0 +1,155 @@ +/*!The Make-like Build Utility based on Lua + * + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (C) 2015 - 2017, TBOOX Open Source Group. + * + * @author TitanSnow + * @file gid.c + * + */ + +/* ////////////////////////////////////////////////////////////////////////////////////// + * trace + */ +#define TB_TRACE_MODULE_NAME "gid" +#define TB_TRACE_MODULE_DEBUG (0) + +/* ////////////////////////////////////////////////////////////////////////////////////// + * includes + */ +#include "prefix.h" +#ifndef TB_CONFIG_OS_WINDOWS +# include +# include + +/* ////////////////////////////////////////////////////////////////////////////////////// + * implementation + */ + +// get gid & egid +tb_int_t xm_os_gid(lua_State* lua) +{ + // check + tb_assert_and_check_return_val(lua, 0); + + tb_int_t gidset = -1, egidset = -1; + + tb_int_t argc = lua_gettop(lua); + + if (argc == 1) + { + if (lua_istable(lua, 1)) + { + // os.gid({["gid"] = gid, ["egid"] = egid}) + lua_getfield(lua, 1, "gid"); + lua_getfield(lua, 1, "egid"); + if (!lua_isnil(lua, -1)) + { + if (!lua_isnumber(lua, -1)) + { + lua_pushfstring(lua, "invalid field type(%s) in `egid` for os.gid", luaL_typename(lua, -1)); + lua_error(lua); + return 0; + } + egidset = (tb_int_t)lua_tonumber(lua, -1); + } + lua_pop(lua, 1); + if (!lua_isnil(lua, -1)) + { + if (!lua_isnumber(lua, -1)) + { + lua_pushfstring(lua, "invalid field type(%s) in `gid` for os.gid", luaL_typename(lua, -1)); + lua_error(lua); + return 0; + } + gidset = (tb_int_t)lua_tonumber(lua, -1); + } + lua_pop(lua, 1); + } else if (lua_isnumber(lua, 1)) + { + // os.gid(egid) + egidset = (tb_int_t)lua_tonumber(lua, 1); + } else + { + lua_pushfstring(lua, "invalid argument type(%s) for os.gid", luaL_typename(lua, 1)); + lua_error(lua); + return 0; + } + } else if (argc == 2) + { + // os.gid(gid, egid) + if (!lua_isnil(lua, 1)) + { + if (!lua_isnumber(lua, 1)) + { + lua_pushfstring(lua, "invalid argument type(%s) for os.gid", luaL_typename(lua, 1)); + lua_error(lua); + return 0; + } + gidset = (tb_int_t)lua_tonumber(lua, 1); + } + if (!lua_isnil(lua, 2)) + { + if (!lua_isnumber(lua, 2)) + { + lua_pushfstring(lua, "invalid argument type(%s) for os.gid", luaL_typename(lua, 2)); + lua_error(lua); + return 0; + } + egidset = (tb_int_t)lua_tonumber(lua, 2); + } + } else if (argc != 0) + { + lua_pushstring(lua, "invalid argument count for os.gid"); + lua_error(lua); + return 0; + } + + // store return value + lua_newtable(lua); + + // set gid & egid + if (gidset != -1) + { + lua_pushstring(lua, "setgid_errno"); + lua_pushinteger(lua, setgid(gidset) != 0 ? errno : 0); + lua_settable(lua, -3); + } + if (egidset != -1) + { + lua_pushstring(lua, "setegid_errno"); + lua_pushinteger(lua, setegid(egidset) != 0 ? errno : 0); + lua_settable(lua, -3); + } + + // get gid & egid + gid_t gid = getgid(), egid = getegid(); + + // push + lua_pushstring(lua, "gid"); + lua_pushinteger(lua, gid); + lua_settable(lua, -3); + lua_pushstring(lua, "egid"); + lua_pushinteger(lua, egid); + lua_settable(lua, -3); + + // ok + return 1; +} + +#endif diff --git a/xmake/core/base/os.lua b/xmake/core/base/os.lua index 0bae655b7..a56c199dd 100644 --- a/xmake/core/base/os.lua +++ b/xmake/core/base/os.lua @@ -34,6 +34,7 @@ local string = require("base/string") -- save original interfaces os._uid = os._uid or os.uid +os._gid = os._gid or os.gid os._mkdir = os._mkdir or os.mkdir os._rmdir = os._rmdir or os.rmdir os._tmpdir = os._tmpdir or os.tmpdir @@ -638,6 +639,18 @@ function os.uid(...) return os._UID end +-- get gid +function os.gid(...) + -- get gid + os._GID = {} + if os._gid then + os._GID = os._gid(...) or {} + end + + -- ok? + return os._GID +end + -- check run command as root function os.isroot() -- cgit v1.3.1 From bd775f017f77043aac5b6290c9899f7daf23e172 Mon Sep 17 00:00:00 2001 From: TitanSnow Date: Mon, 22 May 2017 19:37:24 +0800 Subject: add module privilege to manage root privilege --- xmake/core/base/os.lua | 6 +- xmake/core/base/privilege.lua | 92 ++++++++++++++++++++++ xmake/core/main.lua | 9 ++- .../sandbox/modules/import/core/base/privilege.lua | 26 ++++++ 4 files changed, 125 insertions(+), 8 deletions(-) create mode 100644 xmake/core/base/privilege.lua create mode 100644 xmake/core/sandbox/modules/import/core/base/privilege.lua (limited to 'xmake/core/base/os.lua') diff --git a/xmake/core/base/os.lua b/xmake/core/base/os.lua index a56c199dd..ea6d3a9b0 100644 --- a/xmake/core/base/os.lua +++ b/xmake/core/base/os.lua @@ -653,11 +653,7 @@ end -- check run command as root function os.isroot() - - -- get it from cache - if os._ISROOT ~= nil then - return os._ISROOT - end + os._ISROOT = nil -- check it if os.uid().euid == 0 then diff --git a/xmake/core/base/privilege.lua b/xmake/core/base/privilege.lua new file mode 100644 index 000000000..5c66ba5f1 --- /dev/null +++ b/xmake/core/base/privilege.lua @@ -0,0 +1,92 @@ +--!The Make-like Build Utility based on Lua +-- +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +-- Copyright (C) 2015 - 2017, TBOOX Open Source Group. +-- +-- @author TitanSnow +-- @file privilege.lua +-- + +-- define module +local privilege = privilege or {} + +-- load modules +local os = require("base/os") + +-- store privilege +function privilege.store() + -- check if root + if not os.isroot() then + return false + end + + -- find projectdir's owner + local projectdir = xmake._PROJECT_DIR + assert(projectdir) + local owner = os.getown(projectdir) + if not owner then + -- fallback to current dir + owner = os.getown(".") + if not owner then + return false + end + end + + -- set gid + if os.gid(owner.gid).setegid_errno ~= 0 then + return false + end + + -- set uid + if os.uid(owner.uid).seteuid_errno ~= 0 then + return false + end + + -- set flag + privilege._HAS_PRIVILEGE = true + + -- ok + return true +end + +-- check if has stored privilege +function privilege.has() + return privilege._HAS_PRIVILEGE or false +end + +function privilege.get() + -- has? + if privilege._HAS_PRIVILEGE ~= true then + return false + end + + -- set uid + if os.uid(0).seteuid_errno ~= 0 then + return false + end + + -- set gid + if os.gid(0).setegid_errno ~= 0 then + return false + end + + return true +end + +-- return module +return privilege diff --git a/xmake/core/main.lua b/xmake/core/main.lua index b4ca6afab..cda338294 100644 --- a/xmake/core/main.lua +++ b/xmake/core/main.lua @@ -32,6 +32,7 @@ local utils = require("base/utils") local option = require("base/option") local profiler = require("base/profiler") local deprecated = require("base/deprecated") +local privilege = require("base/privilege") local task = require("project/task") local history = require("project/history") @@ -143,12 +144,14 @@ function main.done() -- check run command as root if not option.get("root") then if os.isroot() then - utils.error([[Running xmake as root is extremely dangerous and no longer supported. + if not privilege.store() or os.isroot() then + utils.error([[Running xmake as root is extremely dangerous and no longer supported. As xmake does not drop privileges on installation you would be giving all build scripts full access to your system. Or you can add `--root` option to allow run as root temporarily. - ]]) - return -1 + ]]) + return -1 + end end end diff --git a/xmake/core/sandbox/modules/import/core/base/privilege.lua b/xmake/core/sandbox/modules/import/core/base/privilege.lua new file mode 100644 index 000000000..8f94cdb79 --- /dev/null +++ b/xmake/core/sandbox/modules/import/core/base/privilege.lua @@ -0,0 +1,26 @@ +--!The Make-like Build Utility based on Lua +-- +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +-- Copyright (C) 2015 - 2017, TBOOX Open Source Group. +-- +-- @author TitanSnow +-- @file privilege.lua +-- + +-- return module +return require("base/privilege") -- cgit v1.3.1