Return to lcinstallfile CVS log

Up to [LON-CAPA] / loncom

Debugged - this installs a table file (setuid) on bahalf of the lond.

    1: #!/usr/bin/perl
    2: #
    3: ## Copyright Michigan State University Board of Trustees
    4: #
    5: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
    6: #
    7: # LON-CAPA is free software; you can redistribute it and/or modify
    8: # it under the terms of the GNU General Public License as published by
    9: # the Free Software Foundation; either version 2 of the License, or 
   10: # (at your option) any later version.
   11: #
   12: # LON-CAPA is distributed in the hope that it will be useful,
   13: # but WITHOUT ANY WARRANTY; without even the implied warranty of
   14: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   15: # GNU General Public License for more details.
   16: #
   17: # You should have received a copy of the GNU General Public License
   18: # along with LON-CAPA; if not, write to the Free Software
   19: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   20: #
   21: # /home/httpd/html/adm/gpl.txt
   22: #
   23: #
   24: #
   25: # 2/17/2009 - Ron FOx
   26: # $Id:
   27: #
   28: # http://www.lon-capa.org/
   29: #
   30: #  This file is a setuid script that allows lond or other www programs to install
   31: #  a file in the lon capa table directory.
   32: #
   33: #  Invocation is as follows:
   34: #    lcinstallfile  source_file_name dest_name
   35: #
   36: #  source_file_name - The full path for the source file.
   37: #  dest_name        - The destination filename.  This will always be in the
   38: #                     table file directory for this server.
   39: #
   40: 
   41: 
   42: use strict;
   43: 
   44: my $LONCAPAHOME = '/home/httpd';	     # Adjust if loncapa isn't installed here.
   45: 
   46: use lib "/home/httpd/lib/perl";
   47: use LONCAPA;
   48: use LONCAPA::Configuration;
   49: use IO::File;
   50: use File::Copy;
   51: 
   52: 
   53: 
   54: #
   55: # Exit codes:
   56: #
   57: # 0    - ok
   58: # 1    - Initial user ID was not www
   59: # 3    - Usage error not enough command line arguments.
   60: # 4    - source_file_name does not exist.
   61: # 5    - destination file does not exist (not allowed to create new files).
   62: # 6    - Some file operation failed.
   63: # 7    - Invalid table filename.
   64: #
   65: my $noprint = 0;
   66: #
   67: #   Ensure we are www:
   68: #
   69: # 
   70: 
   71: my $wwwid=getpwnam('www');
   72: &disable_root_capability;
   73: if ($wwwid!=$>) {
   74:     print("User ID mismatch.  This program must be run as user 'www'\n")
   75: 	unless $noprint;
   76:     exit 1;
   77: }
   78: #
   79: #  Ensure we have the right number of command args:
   80: #
   81: my $argc = scalar(@ARGV);
   82: if ($argc != 2) {
   83:     print("Usage: lcinstallfile sourcepath destfile\n") unless $noprint;
   84:     exit 2;
   85: }
   86: my $sourcepath = $ARGV[0];
   87: my $destfile  = $ARGV[1];
   88: 
   89: 
   90: 
   91: # Ensure the source file exists, and root can write it.:
   92: 
   93: # since this is a setuid program, the sourcepath and destfile
   94: # must be pattern extracted else they are considered insecure and
   95: # therefore not validated.  
   96: # loncapa table files are all of the form.
   97: #  something.tab where something is all letters and _'s.
   98: #
   99: if ($sourcepath =~ /^(\w+\.tab)$/) {
  100:     $sourcepath = $1;
  101: } else {
  102:     print ("Invalid characters in filename $sourcepath \n") unless $noprint;
  103:     exit 7;
  104: }
  105: 
  106: 
  107: if (! -r $sourcepath) {
  108:     print("File $sourcepath either does not exist or cannot be read") unless $noprint;
  109:     exit 4;
  110:     
  111: }
  112: &enable_root_capability;
  113: 
  114: #
  115: #  Figure out where the lontab directory is and create the destinationfile name:
  116: #
  117: #  We're not allowed to create new files, only replace existing files
  118: #  so ensure that the final destination file actually exists.
  119: #
  120: my $config_vars = LONCAPA::Configuration::read_conf('loncapa.conf');
  121: my %config      = %{$config_vars};
  122: my $tab_dir     = $config{'lonTabDir'};
  123: 
  124: my $final_file  = $tab_dir.'/'.$destfile;
  125: 
  126: #
  127: # Now sanitize the final file:
  128: 
  129: if ($final_file =~ /^([\w\/]+\.tab)$/) {
  130:     $final_file = $1;
  131: } else {
  132:     print ("$final_file failed regexp match\n") unless $noprint;
  133:     exit 7;
  134: }
  135: 
  136: if (! -w $final_file) {
  137:     &disable_root_capability;
  138:     print("The $final_file is either not writable, or does not exist.\n") unless $noprint;
  139:     exit 5;
  140: }
  141: #
  142: # Copy the destination file to a backup:
  143: #
  144: if (!copy($final_file, $final_file.'.backup')) {
  145:     &disable_root_capability;
  146:     print ("Failed to create backup copy of $final_file\n") unless $noprint;
  147:     exit 6;
  148: }
  149: &enable_root_capability;
  150: 
  151: #  Install the new file to a temp file in the same dir so it can be mv'd in place
  152: #  this prevents the possibility we wind up with a partial file.:
  153: 
  154: if (!copy($sourcepath, $final_file.'.new')) {
  155:     &disable_root_capability;
  156:     print("Failed to copy $sourcepath to a tempfile\n") unless $noprint;
  157:     exit 6;
  158: }
  159: #
  160: #  Move the temp file to the final file
  161: #
  162: if (!rename($final_file.'.new', $final_file)) {
  163:     &disable_root_capability;
  164:     print ("Failed to move installed file $final_file.new to final resting place\n")
  165: 	unless $noprint;
  166:     exit 6;
  167: }
  168: 
  169: #  Ready to exit with success
  170: 
  171: &disable_root_capability;
  172: print ("$sourcepath installed to $final_file\n") unless $noprint;
  173: exit 0;
  174: 
  175: 
  176: #-------------------------------------------------------------------------
  177: #
  178: #  subs that control the setuid-edness of the program.
  179: 
  180: #  have setuid script run as root
  181: sub enable_root_capability {
  182:     if ($wwwid==$>) {
  183: 	($<,$>)=($>,0);
  184: 	($(,$))=($),0);
  185:     }
  186:     else {
  187: 	# root capability is already enabled
  188:     }
  189:     return $>;
  190: }
  191: 
  192: #  have setuid script run as www
  193: sub disable_root_capability {
  194:     if ($wwwid==$<) {
  195: 	($<,$>)=($>,$<);
  196: 	($(,$))=($),$();
  197:     }
  198:     else {
  199: 	# root capability is already disabled
  200:     }
  201: }