Minix/pkgsrc-ng
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Import of pkgsrc-2013Q2

Browse Source
This commit is contained in:
Lionel Sambuc
2013-09-26 17:14:40 +02:00
commit 785076ae39
74991 changed files with 4380255 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
shells/rssh/DESCR Normal file
View File

@@ -0,0 +1,4 @@
Rssh is a restricted shell for use with OpenSSH, allowing only scp
and/or sftp. For example, if you have a server which you only want
to allow users to copy files off of via scp, without providing
shell access, you can use rssh to do that.

7
shells/rssh/MESSAGE Normal file
View File

@@ -0,0 +1,7 @@
===========================================================================
$NetBSD: MESSAGE,v 1.1.1.1 2005/04/20 16:21:15 seb Exp $
You should configure PermitUserEnvironment in your sshd_config to no.
If you do not do this, it will be possible for users to circumvent rssh.
===========================================================================

52
shells/rssh/Makefile Normal file
View File

@@ -0,0 +1,52 @@
# $NetBSD: Makefile,v 1.16 2013/02/28 19:33:02 darcy Exp $
DISTNAME= rssh-2.3.4
PKGREVISION= 1
CATEGORIES= shells security
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=rssh/}
MAINTAINER= pkgsrc-users@NetBSD.org
HOMEPAGE= http://www.pizzashack.org/rssh/
COMMENT= Restricted shell allowing only scp and/or sftp
LICENSE= 2-clause-bsd
GNU_CONFIGURE= yes
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR}
.if !exists(/usr/include/wordexp.h)
PKG_FAIL_REASON+= "${PKGNAME} requires wordexp(3)"
.endif
EGDIR= ${PREFIX}/share/examples/rssh
INSTALLATION_DIRS= share/examples/rssh
CONF_FILES= ${EGDIR}/rssh.conf ${PKG_SYSCONFDIR}/rssh.conf
PKG_SHELL?= bin/rssh
SPECIAL_PERMS+= ${PREFIX}/libexec/rssh_chroot_helper ${SETUID_ROOT_PERMS}
BUILD_DEFS+= RSSH_SCP_PATH
BUILD_DEFS+= RSSH_SFTP_SERVER_PATH
BUILD_DEFS+= RSSH_CVS_PATH
BUILD_DEFS+= RSSH_RDIST_PATH
BUILD_DEFS+= RSSH_RSYNC_PATH
.if defined(RSSH_SCP_PATH) && !empty(RSSH_SCP_PATH)
CONFIGURE_ARGS+= --with-scp=${RSSH_SCP_PATH:Q}
.endif
.if defined(RSSH_SFTP_SERVER_PATH) && !empty(RSSH_SFTP_SERVER_PATH)
CONFIGURE_ARGS+= --with-sftp-server=${RSSH_SFTP_SERVER_PATH:Q}
.endif
.if defined(RSSH_CVS_PATH) && !empty(RSSH_CVS_PATH)
CONFIGURE_ARGS+= --with-cvs=${RSSH_CVS_PATH:Q}
.endif
.if defined(RSSH_RDIST_PATH) && !empty(RSSH_RDIST_PATH)
CONFIGURE_ARGS+= --with-rdist=${RSSH_RDIST_PATH:Q}
.endif
.if defined(RSSH_RSYNC_PATH) && !empty(RSSH_RSYNC_PATH)
CONFIGURE_ARGS+= --with-rsync=${RSSH_RSYNC_PATH:Q}
.endif
post-install:
${INSTALL_DATA} ${WRKSRC}/rssh.conf.default ${DESTDIR}${EGDIR}/rssh.conf
.include "../../mk/bsd.pkg.mk"

6
shells/rssh/PLIST Normal file
View File

@@ -0,0 +1,6 @@
@comment $NetBSD: PLIST,v 1.2 2009/06/14 18:14:21 joerg Exp $
bin/rssh
libexec/rssh_chroot_helper
man/man1/rssh.1
man/man5/rssh.conf.5
share/examples/rssh/rssh.conf

9
shells/rssh/distinfo Normal file
View File

@@ -0,0 +1,9 @@
$NetBSD: distinfo,v 1.8 2013/02/28 19:33:02 darcy Exp $
SHA1 (rssh-2.3.4.tar.gz) = e13ae1fdce4b0c89ef70f4695689139c8409e2e8
RMD160 (rssh-2.3.4.tar.gz) = 4fdd086820fe67f6dc97671875c43dcad9c4afd3
Size (rssh-2.3.4.tar.gz) = 113315 bytes
SHA1 (patch-aa) = 0210a1c717098e6afa760192cc8f9d6811d2fd9f
SHA1 (patch-ab) = 19a5f7ffe3fef0c6aa17c1611c564c45a802ea96
SHA1 (patch-rsshconf.c) = a2c2b14bf3619f77cf4e3cbfeaaa4b356d145443
SHA1 (patch-util.c) = dcfb7943662aaa733e99d78a810582af1d5d5581

24
shells/rssh/patches/patch-aa Normal file
View File

@@ -0,0 +1,24 @@
$NetBSD: patch-aa,v 1.4 2012/11/28 13:54:55 wiz Exp $
Use pkgsrc framework for installing config files.
Use pkgsrc framework for setuid permissions.
--- Makefile.in.orig 2012-11-27 00:19:34.000000000 +0000
+++ Makefile.in
@@ -672,7 +672,7 @@ info-am:
install-data-am: install-man
-install-exec-am: install-binPROGRAMS install-dist_sysconfDATA \
+install-exec-am: install-binPROGRAMS \
install-libexecPROGRAMS
@$(NORMAL_INSTALL)
$(MAKE) $(AM_MAKEFLAGS) install-exec-hook
@@ -730,7 +730,6 @@ uninstall-man: uninstall-man1 uninstall-
$(CC) -c $(DEFS) $(ourdefs) $(AM_CFLAGS) $(CPPFLAGS) $(LDFLAGS) $<
install-exec-hook:
- chmod u+s $(libexecdir)/rssh_chroot_helper
rpm: dist
rpmbuild -ta --sign $(base).tar.gz

26
shells/rssh/patches/patch-ab Normal file
View File

@@ -0,0 +1,26 @@
$NetBSD: patch-ab,v 1.2 2010/10/16 09:57:39 adam Exp $
--- main.c.in.orig 2010-08-01 19:43:30.000000000 +0000
+++ main.c.in
@@ -198,7 +198,7 @@ char **build_shell_args( struct passwd u
* build_arg_vector() in the chroot helper instead...
*/
- if ( !(argvec = (char **)malloc(6 * sizeof (char *))) ){
+ if ( !(argvec = (char **)malloc(4 * sizeof (char *))) ){
log_set_priority(LOG_ERR);
log_msg("OOM error in build_shell_args() (fatal)");
exit(1);
@@ -229,9 +229,9 @@ char **build_shell_args( struct passwd u
/* change the command to run to the chroot helper */
*cmd = PATH_CHROOT_HELPER;
- /* set up buffer to log command line ('"' + ' ' + '\0' = 9) */
- len = strlen(cmdline) + strlen(argvec[2]) +
- strlen(PATH_CHROOT_HELPER) + 9;
+ /* set up buffer to log command line (argvec[1] + '"' + ' ' + '\0' = 6) */
+ len = strlen(cmdline) +
+ strlen(PATH_CHROOT_HELPER) + 6;
if ( !(temp = (char *)malloc(len)) ){
log_set_priority(LOG_ERR);
log_msg("OOM error in build_shell_args() (fatal)");

370
shells/rssh/patches/patch-rsshconf.c Normal file
View File

@@ -0,0 +1,370 @@
$NetBSD: patch-rsshconf.c,v 1.1 2012/11/01 19:30:58 joerg Exp $
--- rsshconf.c.orig 2012-10-30 19:27:54.000000000 +0000
+++ rsshconf.c
@@ -78,7 +78,7 @@ const char *keywords[] = {
NULL
};
-int log=0;
+int my_log=0;
/* flag to tell config parser to stop processing config file */
static bool got_user_config = FALSE;
@@ -132,11 +132,11 @@ int read_shell_config( ShellOptions_t *o
int status = TRUE; /* were all the cfg lines good? */
char line[CFG_LINE_LEN + 1]; /* buffer to hold region */
- log = do_log;
+ my_log = do_log;
memset(line, 0, CFG_LINE_LEN + 1);
cfg_file = fopen(filename, "r");
if (!cfg_file) {
- if (log){
+ if (my_log){
log_set_priority(LOG_WARNING);
log_msg("config file (%s) missing, using defaults",
filename);
@@ -174,7 +174,7 @@ int process_config_line( ShellOptions_t
*newline = '\0';
else {
/* there is no newline - log the error and find the EOL */
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("line %d: line too long", lineno);
}
@@ -241,12 +241,12 @@ int process_config_line( ShellOptions_t
return TRUE;
default:
/* the keyword is unknown */
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("line %d: syntax error parsing config file",
lineno);
}
- if ( keywrd[0] && log )
+ if ( keywrd[0] && my_log )
log_msg("unknown keyword: %s", keywrd);
return FALSE;
}
@@ -330,7 +330,7 @@ int get_token( const char *str, char *bu
/* initialize strings and pointers */
memset(buf, 0, buflen);
if ( !(copy = strdup(str)) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("OOM error in get_token() (fatal)");
}
@@ -433,11 +433,11 @@ int process_allow_scp( ShellOptions_t *o
const int lineno )
{
if ( !eat_comment(line) ){
- if (log) log_msg("line %d: syntax error parsing config file",
+ if (my_log) log_msg("line %d: syntax error parsing config file",
lineno);
return FALSE;
}
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("allowing scp to all users");
}
@@ -460,11 +460,11 @@ int process_allow_sftp( ShellOptions_t *
int pos;
if ( !(pos = eat_comment(line)) ){
- if (log) log_msg("line %d: syntax error parsing config file",
+ if (my_log) log_msg("line %d: syntax error parsing config file",
lineno);
return FALSE;
}
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("allowing sftp to all users");
}
@@ -488,11 +488,11 @@ int process_allow_cvs( ShellOptions_t *o
int pos;
if ( !(pos = eat_comment(line)) ){
- if (log) log_msg("line %d: syntax error parsing config file",
+ if (my_log) log_msg("line %d: syntax error parsing config file",
lineno);
return FALSE;
}
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("allowing cvs to all users");
}
@@ -516,12 +516,12 @@ int process_allow_rdist( ShellOptions_t
int pos;
if ( !(pos = eat_comment(line)) ){
- if (log) log_msg("line %d: syntax error parsing config file",
+ if (my_log) log_msg("line %d: syntax error parsing config file",
lineno);
return FALSE;
}
log_set_priority(LOG_INFO);
- if (log){
+ if (my_log){
log_msg("allowing rdist to all users");
opts->shell_flags |= RSSH_ALLOW_RDIST;
}
@@ -544,11 +544,11 @@ int process_allow_rsync( ShellOptions_t
int pos;
if ( !(pos = eat_comment(line)) ){
- if (log) log_msg("line %d: syntax error parsing config file",
+ if (my_log) log_msg("line %d: syntax error parsing config file",
lineno);
return FALSE;
}
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("allowing rsync to all users");
}
@@ -573,7 +573,7 @@ int process_chroot_path( ShellOptions_t
*/
if ( !(temp = (char *)malloc(CFG_LINE_LEN + 1)) ){
- if (log) log_msg("fatal error: can't allocate space for chroot path");
+ if (my_log) log_msg("fatal error: can't allocate space for chroot path");
exit(1);
}
/* get_asgn_param() eats trailing comments, so we won't */
@@ -584,7 +584,7 @@ int process_chroot_path( ShellOptions_t
/* get rid of any old value for chroot path, assign new one */
if ( opts->chroot_path ) free(opts->chroot_path);
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("chrooting all users to %s", temp);
}
@@ -605,7 +605,7 @@ int process_log_facility( ShellOptions_t
int pos;
if ( !(temp = (char *)malloc(CFG_LINE_LEN + 1)) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("fatal error: can't allocate space for log facility");
}
@@ -778,17 +778,17 @@ int process_log_facility( ShellOptions_t
free(temp);
if ( !eat_comment(line + pos) ){
- if (log) log_msg("line %d: syntax error parsing config file",
+ if (my_log) log_msg("line %d: syntax error parsing config file",
lineno);
return FALSE;
}
if ( facname ){
log_set_priority(LOG_INFO);
- if (log) log_msg("setting log facility to %s", facname);
+ if (my_log) log_msg("setting log facility to %s", facname);
log_set_facility(fac);
return TRUE;
}
- if (log){
+ if (my_log){
log_msg("line %d: unknown log facility specified", lineno);
log_set_facility(LOG_USER);
}
@@ -804,7 +804,7 @@ int process_umask( ShellOptions_t *opts,
int mask; /* umask */
if ( !(temp = (char *)malloc(CFG_LINE_LEN + 1)) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("fatal error: can't allocate space in process_umask()");
}
@@ -818,7 +818,7 @@ int process_umask( ShellOptions_t *opts,
/* convert the umask to a number */
if ( !validate_umask(temp, &mask) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_WARNING);
log_msg("line %d: invalid umask specified, using default 077",
lineno);
@@ -827,7 +827,7 @@ int process_umask( ShellOptions_t *opts,
free(temp);
return FALSE;
}
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("setting umask to %#o", mask);
}
@@ -857,7 +857,7 @@ int process_user( ShellOptions_t *opts,
/* make space for user options */
if ( !(temp = (char *)malloc(CFG_LINE_LEN + 1)) ){
- if (log) log_msg("fatal error: can't allocate space for user options");
+ if (my_log) log_msg("fatal error: can't allocate space for user options");
exit(1);
}
@@ -871,7 +871,7 @@ int process_user( ShellOptions_t *opts,
/* now process individual config bits of temp */
if ( !(pos = get_token(temp, user, CFG_LINE_LEN + 1, TRUE, TRUE )) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing config file, line %d",
lineno);
@@ -888,12 +888,12 @@ int process_user( ShellOptions_t *opts,
* user lines we don't care about...
*/
if ( (strcmp(user, username)) ) return TRUE;
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("line %d: configuring user %s", lineno, user);
}
if ( !(len = eat_colon(temp + pos)) ){
- if (log) log_msg("syntax error parsing config file: line %d ",
+ if (my_log) log_msg("syntax error parsing config file: line %d ",
lineno);
return FALSE;
}
@@ -902,7 +902,7 @@ int process_user( ShellOptions_t *opts,
/* do the umask, but validate it last, since it's non-fatal */
if ( !(len = get_token(temp + pos, mask, CFG_LINE_LEN + 1,
TRUE, FALSE)) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing user umask, line %d", lineno);
}
@@ -912,14 +912,14 @@ int process_user( ShellOptions_t *opts,
/* do the access bits */
if ( !(len = eat_colon(temp + pos)) ){
- if (log) log_msg("syntax error parsing config file: line %d ",
+ if (my_log) log_msg("syntax error parsing config file: line %d ",
lineno);
return FALSE;
}
pos += len;
if ( !(len = get_token(temp + pos, axs, CFG_LINE_LEN + 1,
TRUE, FALSE)) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing user access, line %d", lineno);
}
@@ -927,7 +927,7 @@ int process_user( ShellOptions_t *opts,
}
if ( !validate_access(axs, &allow_sftp, &allow_scp, &allow_cvs,
&allow_rdist, &allow_rsync) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing access bits, line %d", lineno);
}
@@ -939,7 +939,7 @@ int process_user( ShellOptions_t *opts,
if ( !(len = eat_colon(temp + pos)) ) goto cleanup;
pos += len;
if ( !(path = (char *)malloc(CFG_LINE_LEN + 1)) ){
- if (log) log_msg("fatal error: can't allocate space for chroot path");
+ if (my_log) log_msg("fatal error: can't allocate space for chroot path");
exit(1);
}
if ( !(len = get_token(temp + pos, path, CFG_LINE_LEN + 1,
@@ -953,7 +953,7 @@ cleanup:
/* make sure nothing is left */
while ( *(temp + pos) != '\0' && isspace(*(temp + pos)) ) pos++;
if ( *(temp + pos) != '\0' ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing user config: line %d", lineno);
}
@@ -962,14 +962,14 @@ cleanup:
/* now finally validate the umask */
if ( !validate_umask(mask, &tmpmask) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_WARNING);
log_msg("line %d: invalid umask specified, using default",
lineno);
}
tmpmask = 077;
}
- if (log){
+ if (my_log){
log_set_priority(LOG_INFO);
log_msg("setting %s's umask to %#o", user, tmpmask);
}
@@ -981,27 +981,27 @@ cleanup:
opts->shell_flags = 0;
/* now set the user-specific flags */
if ( allow_scp ){
- if (log) log_msg("allowing scp to user %s", user);
+ if (my_log) log_msg("allowing scp to user %s", user);
opts->shell_flags |= RSSH_ALLOW_SCP;
}
if ( allow_sftp ){
- if (log) log_msg("allowing sftp to user %s", user);
+ if (my_log) log_msg("allowing sftp to user %s", user);
opts->shell_flags |= RSSH_ALLOW_SFTP;
}
if ( allow_cvs ){
- if (log) log_msg("allowing cvs to user %s", user);
+ if (my_log) log_msg("allowing cvs to user %s", user);
opts->shell_flags |= RSSH_ALLOW_CVS;
}
if ( allow_rdist ){
- if (log) log_msg("allowing rdist to user %s", user);
+ if (my_log) log_msg("allowing rdist to user %s", user);
opts->shell_flags |= RSSH_ALLOW_RDIST;
}
if ( allow_rsync ){
- if (log) log_msg("allowing rsync to user %s", user);
+ if (my_log) log_msg("allowing rsync to user %s", user);
opts->shell_flags |= RSSH_ALLOW_RSYNC;
}
if ( path ){
- if (log) log_msg("chrooting %s to %s", user, path);
+ if (my_log) log_msg("chrooting %s to %s", user, path);
opts->shell_flags |= RSSH_USE_CHROOT;
}
opts->chroot_path = path;
@@ -1020,7 +1020,7 @@ int get_asgn_param( const char *line,
/* make sure '=' is next token, otherwise syntax error */
if ( (pos = eat_assignment(line)) <= 0 ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("error parsing config file at line %d: "
"assignment expected", lineno);
@@ -1029,7 +1029,7 @@ int get_asgn_param( const char *line,
}
/* get the string parameter of the assignment */
if ( !(len = get_token((line + pos), buf, buflen, FALSE, FALSE)) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing config file, line %d",
lineno);
@@ -1039,7 +1039,7 @@ int get_asgn_param( const char *line,
pos += len;
/* check for ending comment */
if ( !eat_comment(line + pos) ){
- if (log){
+ if (my_log){
log_set_priority(LOG_ERR);
log_msg("syntax error parsing config file at line %d",
lineno);

106
shells/rssh/patches/patch-util.c Normal file
View File

@@ -0,0 +1,106 @@
$NetBSD: patch-util.c,v 1.1 2013/02/28 19:33:02 darcy Exp $
- Patch from Debian to allow rsync to work with rssh
--- util.c.orig 2012-11-27 01:14:49.000000000 +0000
+++ util.c
@@ -56,6 +56,7 @@
#ifdef HAVE_LIBGEN_H
#include <libgen.h>
#endif /* HAVE_LIBGEN_H */
+#include <regex.h>
/* LOCAL INCLUDES */
#include "pathnames.h"
@@ -196,6 +197,71 @@ bool check_command( char *cl, ShellOptio
return rc;
}
+/*
+ * rsync_e_okay() - take the command line passed to rssh and look for an -e
+ * option. If one is found, make sure --server is provided
+ * and the option contains only the protocol information.
+ * Also check for and reject any --rsh option. Returns FALSE
+ * if the command line should not be allowed, TRUE if it is
+ * okay.
+ */
+static int rsync_e_okay( char **vec )
+{
+ regex_t re;
+ int server = FALSE;
+ int e_found = FALSE;
+
+ /*
+ * rsync will send -e, followed by either just "." (meaning no special
+ * protocol) or "N.N" (meaning a pre-release protocol version),
+ * followed by some number of alphabetic flags indicating various
+ * supported options. There may be other options between - and the e,
+ * but -e will always be the last option in the string. A typical
+ * option passed by the client is "-ltpre.iL".
+ *
+ * Note that if --server is given, this should never be parsed as a
+ * shell, but we'll tightly verify it anyway, just in case.
+ *
+ * This regex matches the acceptable flags containing -e, so if it
+ * does not match, the command line should be rejected.
+ */
+ static const char pattern[]
+ = "^-[a-df-zA-Z]*e[0-9]*\\.[0-9]*[a-zA-Z]*$";
+
+ /*
+ * Only recognize --server if it's the first option. rsync itself
+ * always passes it that way, and if it's not the first argument, it
+ * could be hidden from the server as an argument to some other
+ * option.
+ */
+ if ( vec && vec[0] && vec[1] && strcmp(vec[1], "--server") == 0 ){
+ server = TRUE;
+ }
+
+ /* Check the remaining options for -e or --rsh. */
+ if ( regcomp(&re, pattern, REG_EXTENDED | REG_NOSUB) != 0 ){
+ return FALSE;
+ }
+ while (vec && *vec){
+ if ( strcmp(*vec, "--") == 0 ) break;
+ if ( strcmp(*vec, "--rsh") == 0
+ || strncmp(*vec, "--rsh=", strlen("--rsh=")) == 0 ){
+ regfree(&re);
+ return FALSE;
+ }
+ if ( strncmp(*vec, "--", 2) != 0 && opt_exist(*vec, 'e') ){
+ e_found = TRUE;
+ if ( regexec(&re, *vec, 0, NULL, 0) != 0 ){
+ regfree(&re);
+ return FALSE;
+ }
+ }
+ vec++;
+ }
+ regfree(&re);
+ if ( e_found && !server ) return FALSE;
+ return TRUE;
+}
/*
* check_command_line() - take the command line passed to rssh, and verify
@@ -230,14 +296,11 @@ char *check_command_line( char **cl, She
if ( check_command(*cl, opts, PATH_RSYNC, RSSH_ALLOW_RSYNC) ){
/* filter -e option */
- if ( opt_filter(cl, 'e') ) return NULL;
- while (cl && *cl){
- if ( strstr(*cl, "--rsh" ) ){
- fprintf(stderr, "\ninsecure --rsh= not allowed.");
- log_msg("insecure --rsh option in rsync command line!");
- return NULL;
- }
- cl++;
+ if ( !rsync_e_okay(cl) ){
+ fprintf(stderr, "\ninsecure -e or --rsh option not allowed.");
+ log_msg("insecure -e or --rsh option in rsync command line!");
+ return NULL;
+
}
return PATH_RSYNC;
}