libext2fs: use a safe_getenv() function everywhere

Hoist safe_getenv() from test_io.c and unix_io.c to a globally
exported ext2fs_safe_getenv() and use it instead of getenv() in
libext2fs.  This provides a bit more safety if e2fsprogs programs are
used in setuid contexts.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/debian/libext2fs2t64.symbols b/debian/libext2fs2t64.symbols
index 82c0960..7e47427 100644 (file)
--- a/debian/libext2fs2t64.symbols
+++ b/debian/libext2fs2t64.symbols
@@ -414,7 +414,7 @@ libext2fs.so.2 libext2fs2t64 #MINVER#
  ext2fs_is_fast_symlink@Base 1.44.0~rc1
  ext2fs_journal_sb_start@Base 1.42.12
  ext2fs_link@Base 1.37
- ext2fs_list_backups@Base 1.47.1~rc1
+ Ext2fs_list_backups@Base 1.47.1~rc1
  ext2fs_llseek@Base 1.37
  ext2fs_lookup@Base 1.37
  ext2fs_make_generic_bitmap@Base 1.41.0
@@ -511,6 +511,7 @@ libext2fs.so.2 libext2fs2t64 #MINVER#
  ext2fs_rewrite_to_io@Base 1.37
  ext2fs_rw_bitmaps@Base 1.46.0
  ext2fs_set_alloc_block_callback@Base 1.41.0
+ ext2fs_safe_getenv@Base 1.47.1~rc1
  ext2fs_set_bit64@Base 1.42
  ext2fs_set_bit@Base 1.37
  ext2fs_set_bitmap_padding@Base 1.37

diff --git a/lib/ext2fs/Makefile.in b/lib/ext2fs/Makefile.in
index 36c3e8e..e9c23d3 100644 (file)
--- a/lib/ext2fs/Makefile.in
+++ b/lib/ext2fs/Makefile.in
@@ -93,6 +93,7 @@ OBJS= $(DEBUGFS_LIB_OBJS) $(RESIZE_LIB_OBJS) $(E2IMAGE_LIB_OBJS) \
        gen_bitmap64.o \
        get_num_dirs.o \
        get_pathname.o \
+       getenv.o \
        getsize.o \
        getsectsize.o \
        hashmap.o \
@@ -175,6 +176,7 @@ SRCS= ext2_err.c \
        $(srcdir)/gen_bitmap64.c \
        $(srcdir)/get_num_dirs.c \
        $(srcdir)/get_pathname.c \
+       $(srcdir)/getenv.c \
        $(srcdir)/getsize.c \
        $(srcdir)/getsectsize.c \
        $(srcdir)/hashmap.c \
@@ -903,6 +905,12 @@ get_pathname.o: $(srcdir)/get_pathname.c $(top_builddir)/lib/config.h \
  $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h $(top_srcdir)/lib/et/com_err.h \
  $(srcdir)/ext2_io.h $(top_builddir)/lib/ext2fs/ext2_err.h \
  $(srcdir)/ext2_ext_attr.h $(srcdir)/hashmap.h $(srcdir)/bitops.h
+getenv.o: $(srcdir)/getenv.c $(top_builddir)/lib/config.h \
+ $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2fs.h \
+ $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2_fs.h \
+ $(srcdir)/ext3_extents.h $(top_srcdir)/lib/et/com_err.h $(srcdir)/ext2_io.h \
+ $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
+ $(srcdir)/hashmap.h $(srcdir)/bitops.h
 getsize.o: $(srcdir)/getsize.c $(top_builddir)/lib/config.h \
  $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2_fs.h \
  $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2fs.h \
@@ -1056,6 +1064,13 @@ openfs.o: $(srcdir)/openfs.c $(top_builddir)/lib/config.h \
  $(srcdir)/ext2_io.h $(top_builddir)/lib/ext2fs/ext2_err.h \
  $(srcdir)/ext2_ext_attr.h $(srcdir)/hashmap.h $(srcdir)/bitops.h \
  $(srcdir)/e2image.h
+orphan.o: $(srcdir)/orphan.c $(top_builddir)/lib/config.h \
+ $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2_fs.h \
+ $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2fsP.h \
+ $(srcdir)/ext2fs.h $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h \
+ $(top_srcdir)/lib/et/com_err.h $(srcdir)/ext2_io.h \
+ $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
+ $(srcdir)/hashmap.h $(srcdir)/bitops.h
 progress.o: $(srcdir)/progress.c $(top_builddir)/lib/config.h \
  $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2fs.h \
  $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2_fs.h \
@@ -1420,23 +1435,23 @@ e2freefrag.o: $(top_srcdir)/misc/e2freefrag.c $(top_builddir)/lib/config.h \
  $(top_srcdir)/lib/support/dqblk_v2.h \
  $(top_srcdir)/lib/support/quotaio_tree.h
 create_inode.o: $(top_srcdir)/misc/create_inode.c \
- $(top_srcdir)/misc/create_inode_libarchive.c \
  $(top_builddir)/lib/config.h $(top_builddir)/lib/dirpaths.h \
  $(srcdir)/ext2fs.h $(top_builddir)/lib/ext2fs/ext2_types.h \
  $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h $(top_srcdir)/lib/et/com_err.h \
  $(srcdir)/ext2_io.h $(top_builddir)/lib/ext2fs/ext2_err.h \
  $(srcdir)/ext2_ext_attr.h $(srcdir)/hashmap.h $(srcdir)/bitops.h \
  $(srcdir)/fiemap.h $(top_srcdir)/misc/create_inode.h \
- $(top_srcdir)/lib/e2p/e2p.h $(top_srcdir)/lib/support/nls-enable.h
+ $(top_srcdir)/lib/e2p/e2p.h $(top_srcdir)/lib/support/nls-enable.h \
+ $(top_srcdir)/misc/create_inode_libarchive.h
 create_inode_libarchive.o: $(top_srcdir)/misc/create_inode_libarchive.c \
- $(top_srcdir)/misc/create_inode_libarchive.c \
  $(top_builddir)/lib/config.h $(top_builddir)/lib/dirpaths.h \
- $(srcdir)/ext2fs.h $(top_builddir)/lib/ext2fs/ext2_types.h \
- $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h $(top_srcdir)/lib/et/com_err.h \
+ $(top_builddir)/lib/ext2fs/ext2_types.h $(top_srcdir)/misc/create_inode.h \
+ $(top_srcdir)/lib/et/com_err.h $(top_srcdir)/lib/e2p/e2p.h \
+ $(srcdir)/ext2_fs.h $(srcdir)/ext2fs.h $(srcdir)/ext3_extents.h \
  $(srcdir)/ext2_io.h $(top_builddir)/lib/ext2fs/ext2_err.h \
  $(srcdir)/ext2_ext_attr.h $(srcdir)/hashmap.h $(srcdir)/bitops.h \
- $(srcdir)/fiemap.h $(top_srcdir)/misc/create_inode.h \
- $(top_srcdir)/lib/e2p/e2p.h $(top_srcdir)/lib/support/nls-enable.h
+ $(top_srcdir)/misc/create_inode_libarchive.h \
+ $(top_srcdir)/lib/support/nls-enable.h
 journal.o: $(top_srcdir)/debugfs/journal.c $(top_builddir)/lib/config.h \
  $(top_builddir)/lib/dirpaths.h $(top_srcdir)/debugfs/journal.h \
  $(srcdir)/../../e2fsck/jfs_user.h $(srcdir)/ext2_fs.h \

diff --git a/lib/ext2fs/ext2fs.h b/lib/ext2fs/ext2fs.h
index 624c1a1..f3d98f6 100644 (file)
--- a/lib/ext2fs/ext2fs.h
+++ b/lib/ext2fs/ext2fs.h
@@ -1559,6 +1559,9 @@ errcode_t ext2fs_count_used_blocks(ext2_filsys fs, blk64_t start,
 extern unsigned int ext2fs_list_backups(ext2_filsys fs, unsigned int *three,
                                unsigned int *five, unsigned int *seven);
 
+/* getenv.c */
+extern char *ext2fs_safe_getenv(const char *arg);
+
 /* get_num_dirs.c */
 extern errcode_t ext2fs_get_num_dirs(ext2_filsys fs, ext2_ino_t *ret_num_dirs);
 

diff --git a/lib/ext2fs/gen_bitmap64.c b/lib/ext2fs/gen_bitmap64.c
index 5936dcf..4874555 100644 (file)
--- a/lib/ext2fs/gen_bitmap64.c
+++ b/lib/ext2fs/gen_bitmap64.c
@@ -257,7 +257,7 @@ void ext2fs_free_generic_bmap(ext2fs_generic_bitmap gen_bmap)
                return;
 
 #ifdef ENABLE_BMAP_STATS
-       if (getenv("E2FSPROGS_BITMAP_STATS")) {
+       if (ext2fs_safe_getenv("E2FSPROGS_BITMAP_STATS")) {
                ext2fs_print_bmap_statistics(bmap);
                bmap->bitmap_ops->print_stats(bmap);
        }

diff --git a/lib/ext2fs/initialize.c b/lib/ext2fs/initialize.c
index 2a08a7e..513bf5a 100644 (file)
--- a/lib/ext2fs/initialize.c
+++ b/lib/ext2fs/initialize.c
@@ -125,7 +125,7 @@ errcode_t ext2fs_initialize(const char *name, int flags,
        fs->flags |= EXT2_FLAG_SWAP_BYTES;
 #endif
 
-       time_env = getenv("E2FSPROGS_FAKE_TIME");
+       time_env = ext2fs_safe_getenv("E2FSPROGS_FAKE_TIME");
        if (time_env)
                fs->now = strtoul(time_env, NULL, 0);
 

diff --git a/lib/ext2fs/ismounted.c b/lib/ext2fs/ismounted.c
index a7db1a5..c1c3102 100644 (file)
--- a/lib/ext2fs/ismounted.c
+++ b/lib/ext2fs/ismounted.c
@@ -108,7 +108,7 @@ static errcode_t check_mntent_file(const char *mtab_file, const char *file,
 
        if ((f = setmntent (mtab_file, "r")) == NULL) {
                if (errno == ENOENT) {
-                       if (getenv("EXT2FS_NO_MTAB_OK"))
+                       if (ext2fs_safe_getenv("EXT2FS_NO_MTAB_OK"))
                                return 0;
                        else
                                return EXT2_ET_NO_MTAB_FILE;
@@ -366,15 +366,15 @@ errcode_t ext2fs_check_mount_point(const char *device, int *mount_flags,
        errcode_t       retval = 0;
        int             busy = 0;
 
-       if (getenv("EXT2FS_PRETEND_RO_MOUNT")) {
+       if (ext2fs_safe_getenv("EXT2FS_PRETEND_RO_MOUNT")) {
                *mount_flags = EXT2_MF_MOUNTED | EXT2_MF_READONLY;
-               if (getenv("EXT2FS_PRETEND_ROOTFS"))
+               if (ext2fs_safe_getenv("EXT2FS_PRETEND_ROOTFS"))
                        *mount_flags = EXT2_MF_ISROOT;
                return 0;
        }
-       if (getenv("EXT2FS_PRETEND_RW_MOUNT")) {
+       if (ext2fs_safe_getenv("EXT2FS_PRETEND_RW_MOUNT")) {
                *mount_flags = EXT2_MF_MOUNTED;
-               if (getenv("EXT2FS_PRETEND_ROOTFS"))
+               if (ext2fs_safe_getenv("EXT2FS_PRETEND_ROOTFS"))
                        *mount_flags = EXT2_MF_ISROOT;
                return 0;
        }

diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
index eb44d58..ed2f7c3 100644 (file)
--- a/lib/ext2fs/openfs.c
+++ b/lib/ext2fs/openfs.c
@@ -149,7 +149,7 @@ errcode_t ext2fs_open2(const char *name, const char *io_options,
        fs->flags |= EXT2_FLAG_MASTER_SB_ONLY;
        fs->umask = 022;
 
-       time_env = getenv("E2FSPROGS_FAKE_TIME");
+       time_env = ext2fs_safe_getenv("E2FSPROGS_FAKE_TIME");
        if (time_env)
                fs->now = strtoul(time_env, NULL, 0);
 

diff --git a/lib/ext2fs/progress.c b/lib/ext2fs/progress.c
index fe4292f..61ab3f0 100644 (file)
--- a/lib/ext2fs/progress.c
+++ b/lib/ext2fs/progress.c
@@ -53,7 +53,7 @@ void ext2fs_numeric_progress_init(ext2_filsys fs,
        backspaces[sizeof(backspaces)-1] = 0;
 
        memset(progress, 0, sizeof(*progress));
-       if (getenv("E2FSPROGS_SKIP_PROGRESS"))
+       if (ext2fs_safe_getenv("E2FSPROGS_SKIP_PROGRESS"))
                progress->skip_progress++;
 
 

diff --git a/lib/ext2fs/test_io.c b/lib/ext2fs/test_io.c
index 6843edb..0324e53 100644 (file)
--- a/lib/ext2fs/test_io.c
+++ b/lib/ext2fs/test_io.c
@@ -23,14 +23,6 @@
 #if HAVE_SYS_TYPES_H
 #include <sys/types.h>
 #endif
-#ifdef HAVE_SYS_PRCTL_H
-#include <sys/prctl.h>
-#else
-#define PR_GET_DUMPABLE 3
-#endif
-#if (!defined(HAVE_PRCTL) && defined(linux))
-#include <sys/syscall.h>
-#endif
 
 #include "ext2_fs.h"
 #include "ext2fs.h"
@@ -144,31 +136,6 @@ static void test_abort(io_channel channel, unsigned long block)
        abort();
 }
 
-static char *safe_getenv(const char *arg)
-{
-#if !defined(_WIN32)
-       if ((getuid() != geteuid()) || (getgid() != getegid()))
-               return NULL;
-#endif
-#if HAVE_PRCTL
-       if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0) == 0)
-               return NULL;
-#else
-#if (defined(linux) && defined(SYS_prctl))
-       if (syscall(SYS_prctl, PR_GET_DUMPABLE, 0, 0, 0, 0) == 0)
-               return NULL;
-#endif
-#endif
-
-#if defined(HAVE_SECURE_GETENV)
-       return secure_getenv(arg);
-#elif defined(HAVE___SECURE_GETENV)
-       return __secure_getenv(arg);
-#else
-       return getenv(arg);
-#endif
-}
-
 static errcode_t test_open(const char *name, int flags, io_channel *channel)
 {
        io_channel      io = NULL;
@@ -217,25 +184,25 @@ static errcode_t test_open(const char *name, int flags, io_channel *channel)
        data->write_blk64 =     test_io_cb_write_blk64;
 
        data->outfile = NULL;
-       if ((value = safe_getenv("TEST_IO_LOGFILE")) != NULL)
+       if ((value = ext2fs_safe_getenv("TEST_IO_LOGFILE")) != NULL)
                data->outfile = fopen(value, "w");
        if (!data->outfile)
                data->outfile = stderr;
 
        data->flags = 0;
-       if ((value = safe_getenv("TEST_IO_FLAGS")) != NULL)
+       if ((value = ext2fs_safe_getenv("TEST_IO_FLAGS")) != NULL)
                data->flags = strtoul(value, NULL, 0);
 
        data->block = 0;
-       if ((value = safe_getenv("TEST_IO_BLOCK")) != NULL)
+       if ((value = ext2fs_safe_getenv("TEST_IO_BLOCK")) != NULL)
                data->block = strtoul(value, NULL, 0);
 
        data->read_abort_count = 0;
-       if ((value = safe_getenv("TEST_IO_READ_ABORT")) != NULL)
+       if ((value = ext2fs_safe_getenv("TEST_IO_READ_ABORT")) != NULL)
                data->read_abort_count = strtoul(value, NULL, 0);
 
        data->write_abort_count = 0;
-       if ((value = safe_getenv("TEST_IO_WRITE_ABORT")) != NULL)
+       if ((value = ext2fs_safe_getenv("TEST_IO_WRITE_ABORT")) != NULL)
                data->write_abort_count = strtoul(value, NULL, 0);
 
        if (data->real) {

diff --git a/lib/ext2fs/undo_io.c b/lib/ext2fs/undo_io.c
index f4a6d52..a1bb405 100644 (file)
--- a/lib/ext2fs/undo_io.c
+++ b/lib/ext2fs/undo_io.c
@@ -809,7 +809,7 @@ static errcode_t undo_close(io_channel channel)
        if (--channel->refcount > 0)
                return 0;
        /* Before closing write the file system identity */
-       if (!getenv("UNDO_IO_SIMULATE_UNFINISHED"))
+       if (!ext2fs_safe_getenv("UNDO_IO_SIMULATE_UNFINISHED"))
                data->hdr.state = ext2fs_cpu_to_le32(E2UNDO_STATE_FINISHED);
        err = write_undo_indexes(data, 1);
        ext2fs_remove_exit_fn(undo_atexit, data);

diff --git a/lib/ext2fs/unix_io.c b/lib/ext2fs/unix_io.c
index 33c5d56..b06df06 100644 (file)
--- a/lib/ext2fs/unix_io.c
+++ b/lib/ext2fs/unix_io.c
@@ -53,11 +53,6 @@
 #ifdef HAVE_SYS_MOUNT_H
 #include <sys/mount.h>
 #endif
-#ifdef HAVE_SYS_PRCTL_H
-#include <sys/prctl.h>
-#else
-#define PR_GET_DUMPABLE 3
-#endif
 #if HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
@@ -182,29 +177,6 @@ static errcode_t unix_get_stats(io_channel channel, io_stats *stats)
        return retval;
 }
 
-static char *safe_getenv(const char *arg)
-{
-       if ((getuid() != geteuid()) || (getgid() != getegid()))
-               return NULL;
-#ifdef HAVE_PRCTL
-       if (prctl(PR_GET_DUMPABLE, 0, 0, 0, 0) == 0)
-               return NULL;
-#else
-#if (defined(linux) && defined(SYS_prctl))
-       if (syscall(SYS_prctl, PR_GET_DUMPABLE, 0, 0, 0, 0) == 0)
-               return NULL;
-#endif
-#endif
-
-#if defined(HAVE_SECURE_GETENV)
-       return secure_getenv(arg);
-#elif defined(HAVE___SECURE_GETENV)
-       return __secure_getenv(arg);
-#else
-       return getenv(arg);
-#endif
-}
-
 /*
  * Here are the raw I/O functions
  */
@@ -728,7 +700,7 @@ static errcode_t unix_open_channel(const char *name, int fd,
        struct          utsname ut;
 #endif
 
-       if (safe_getenv("UNIX_IO_FORCE_BOUNCE"))
+       if (ext2fs_safe_getenv("UNIX_IO_FORCE_BOUNCE"))
                flags |= IO_FLAG_FORCE_BOUNCE;
 
 #ifdef __linux__
@@ -761,7 +733,7 @@ static errcode_t unix_open_channel(const char *name, int fd,
        io->refcount = 1;
        io->flags = 0;
 
-       if (safe_getenv("UNIX_IO_NOZEROOUT"))
+       if (ext2fs_safe_getenv("UNIX_IO_NOZEROOUT"))
                io->flags |= CHANNEL_FLAGS_NOZEROOUT;
 
        memset(data, 0, sizeof(struct unix_private_data));