Linuxのcrontabコマンドの脆弱性をつぶす

static uid_t save_euid;
static gid_t save_egid;

static char Filename[MAX_FNAME];
static FILE *NewCrontab;


int swap_uids(void) {
  save_egid = getegid();
  save_euid = geteuid();
  return ((setegid(getgid()) || seteuid(getuid()))? -1 : 0);
}


int swap_uids_back(void) {
  return ((setegid(save_egid) || seteuid(save_euid)) ? -1 : 0);
}


/*
 * glue_strings is the overflow-safe equivalent of
 *    sprintf(buffer, "%s%c%s", a, separator, b);
 *
 * returns 1 on success, 0 on failure.  'buffer' MUST NOT be used if
 * glue_strings fails.
 */
int
glue_strings(char *buffer, size_t buffer_size, const char *a, const char *b,
  char separator) {
  char *buf;
  char *buf_end;

  if (buffer_size <= 0)
    return (0);
  buf_end = buffer + buffer_size;
  buf = buffer;

  for ( /* nothing */ ; buf < buf_end && *a != '\0'; buf++, a++)
    *buf = *a;
  if (buf == buf_end)
    return (0);
  if (separator != '/' || buf == buffer || buf[-1] != '/')
    *buf++ = separator;
  if (buf == buf_end)
    return (0);
  for ( /* nothing */ ; buf < buf_end && *b != '\0'; buf++, b++)
    *buf = *b;
  if (buf == buf_end)
    return (0);
  *buf = '\0';
  return (1);
}


static char *tmp_path() {
  char *tmpdir = NULL;

  if ((getuid() == geteuid()) && (getgid() == getegid())) {
    tmpdir = getenv("TMPDIR");
  }
  return tmpdir ? tmpdir : "/tmp";
}


static void edit_cmd(void) {
  char n[MAX_FNAME], q[MAX_TEMPSTR];
  FILE *f;
  int ch = '\0', t;
  struct stat statbuf;
  struct utimbuf utimebuf;
  WAIT_T waiter;
  PID_T pid, xpid;

  if (!glue_strings(n, sizeof n, SPOOL_DIR, User, '/')) {
     fprintf(stderr, "path too long\n");
     exit(ERROR_EXIT);
  }
  if (!(f = fopen(n, "r"))) {
    if (errno != ENOENT) {
      perror(n);
      exit(ERROR_EXIT);
    }
    fprintf(stderr, "no crontab for %s - using an empty one\n", User);
    if (!(f = fopen(_PATH_DEVNULL, "r"))) {
      perror(_PATH_DEVNULL);
      exit(ERROR_EXIT);
    }
  }

  if (!glue_strings(Filename, sizeof Filename, tmp_path(),
                    "crontab.XXXXXXXXXX", '/')) {
    fprintf(stderr, "path too long\n");
    exit(ERROR_EXIT);
  }
  if (swap_uids() == -1) {
    perror("swapping uids");
    exit(ERROR_EXIT);
  }
  if (-1 == (t = mkstemp(Filename))) {
    perror(Filename);
    goto fatal;
  }

  if (swap_uids_back() == -1) {
    perror("swapping uids back");
    goto fatal;
  }
  if (!(NewCrontab = fdopen(t, "r+"))) {
    perror("fdopen");
    goto fatal;
  }

  // copy the rest of the crontab (if any) to the temp file.
  if (EOF != ch)
    while (EOF != (ch = get_char(f)))
      putc(ch, NewCrontab);

  fclose(f);
  if (fflush(NewCrontab) < OK) {
    perror(Filename);
    exit(ERROR_EXIT);
  }
  // Set it to 1970
  utimebuf.actime = 0;
  utimebuf.modtime = 0;
  utime(Filename, &utimebuf);
again:
  rewind(NewCrontab);
  if (ferror(NewCrontab)) {
      fprintf(stderr, "%s: error while writing new crontab to %s\n",
                      ProgramName, Filename);
fatal:
      unlink(Filename);
      exit(ERROR_EXIT);
  }

  // we still have the file open.  editors will generally rewrite the
  // original file rather than renaming/unlinking it and starting a
  // new one; even backup files are supposed to be made by copying
  // rather than by renaming.  if some editor does not support this,
  // then don't use it.  the security problems are more severe if we
  // close and reopen the file around the edit.

  switch (pid = fork()) {

    // 子プロセスでroot権限を放棄しFilenameを引数にエディタを起動

  }

  // parent
  for (;;) {
    xpid = waitpid(pid, &waiter, 0);

    // エラー状態だったら異常終了する

  }

  // lstat doesn't make any harm, because 
  // the file is stat'ed only when crontab is touched
  if (lstat(Filename, &statbuf) < 0) {
    perror("lstat");
    goto fatal;
  }

  if (!S_ISREG(statbuf.st_mode)) {
    fprintf(stderr, "%s: illegal crontab\n", ProgramName);
    goto remove;
  }

  if (statbuf.st_mtime == 0) {
    fprintf(stderr, "%s: no changes made to crontab\n", ProgramName);
    goto remove;
  }

  fprintf(stderr, "%s: installing new crontab\n", ProgramName);
  fclose(NewCrontab);
  if (swap_uids() < OK) {
    perror("swapping uids");
    goto remove;
  }
  if (!(NewCrontab = fopen(Filename, "r+"))) {
    perror("cannot read new crontab");
    goto remove;
  }
  if (swap_uids_back() < OK) {
    perror("swapping uids back");
    exit(ERROR_EXIT);
  }
  if (NewCrontab == 0L) {
    perror("fopen");
    goto fatal;
  }

  // 以下、Filenameをcrontabに入れ換える

remove:
    unlink(Filename);
done:
}