aboutsummaryrefslogtreecommitdiffstats
path: root/src/msec_find
diff options
context:
space:
mode:
Diffstat (limited to 'src/msec_find')
-rw-r--r--src/msec_find/Makefile13
-rw-r--r--src/msec_find/find.c233
2 files changed, 246 insertions, 0 deletions
diff --git a/src/msec_find/Makefile b/src/msec_find/Makefile
new file mode 100644
index 0000000..20fb4d9
--- /dev/null
+++ b/src/msec_find/Makefile
@@ -0,0 +1,13 @@
+CC=gcc
+NAME=msec_find
+
+CFLAGS = -ggdb -Wall -Wmissing-prototypes -Wmissing-declarations \
+-Wpointer-arith -m486 -O2 -finline-functions -fkeep-inline-functions
+
+OBJ=find.o
+
+msec_find: $(OBJ)
+ $(CC) $(OBJ) -o $(NAME)
+
+install:
+ cp $(NAME) /usr/bin
diff --git a/src/msec_find/find.c b/src/msec_find/find.c
new file mode 100644
index 0000000..65e8c73
--- /dev/null
+++ b/src/msec_find/find.c
@@ -0,0 +1,233 @@
+/*
+ * Written by Thierry Vignaud,
+ * heavilly modified for msec purpose by Vandoorselaere Yoann.
+ *
+ * This code is copyrighted by Mandrakesoft [(c) 2000] and is released under
+ * the GPL licence
+ */
+
+
+/*
+ * TODO
+ * +++ hash tables or btree to stock already searched uid/gid for speed
+ * Pb: since linux-2.3.4x, uid & gid are 32 bits wide ... => BTREE?
+ * static char **uid_hash, **gid_hash;
+ *
+ * +++ check for open & I/O error on log files ...
+ * +++ Yoann scripts should avoid /dev if devfs is mounted (either by testing
+ * if /dev is mounted by devfs or if [ -f /dev/.devfsd ] => see with
+ * Yoann
+ * --- disable 'cannot stat ...' warning (???) => better log them SECURITY_LOG
+ * --- disable write test on links => OK
+ */
+
+/*
+ * (Vandoorselaere Yoann)
+ * Done :
+ * - Don't handle FTW_DNR case, since it will print warning for /proc file.
+ * - Don't walk trought /dev & /proc.
+ * - We don't need to handle all of the ftw flag, just the FTW_F & FTW_D one :)
+ * - Use FTW_PHYS to not follow symbolic link.
+ * - Do not use getenv to get the root directory.
+ * - Use argv instead of a DIR variable to get directory to scan.
+ * - Free directory after use when allocated for appending a '/'.
+ * - We do not need __USE_XOPEN_EXTENDED definition.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+
+#define __USE_XOPEN_EXTENDED
+#include <ftw.h>
+
+#include <sys/stat.h>
+
+/* For NSS managment */
+#include <pwd.h>
+#include <grp.h>
+#include <sys/types.h>
+
+#include <string.h>
+
+
+#ifdef __GNUC__
+#define inline
+#else
+#warning upgrade your so-called system to a real OS such as GNU/Linux
+#endif
+
+/*
+ * Log files
+ */
+static FILE *suid_fd;
+static FILE *sgid_fd;
+static FILE *unowned_user_fd;
+static FILE *unowned_group_fd;
+static FILE *writeable_fd;
+
+static int traverse(const char *file, const struct stat *sb, int flag, struct FTW *s)
+{
+ struct passwd *u_nss_data;
+ struct group *g_nss_data;
+
+ if (strncmp(file, "//", 2) == 0 )
+ /*
+ * handle bogus glibc ftw
+ * else we won't print only one '/' in front of file names
+ */
+ file++;
+
+ if (strncmp("/proc", file, 5) == 0)
+ return 0;
+ if (strncmp("/dev", file, 4) == 0)
+ return 0;
+
+ switch (flag) {
+ /*
+ * Here is a difference with security-check.sh:
+ * we don't check for regular files only for Set-UID et Set-GID but
+ * to directories too. Idem for world writable directories ...
+ */
+
+ case FTW_F:
+ /*
+ * Regular file
+ */
+ printf("%s\n", file);
+
+ /*
+ * Is writeable check.
+ */
+ if (sb->st_mode & 0002)
+ fprintf(writeable_fd, "%s\n", file);
+
+ /*
+ * Is suid root check.
+ */
+ if ((sb->st_mode & S_ISUID) && (sb->st_uid == 0))
+ fprintf(suid_fd, "%s\n", file);
+
+ /*
+ * Is suid group check.
+ */
+ if (sb->st_mode & S_ISGID)
+ fprintf(sgid_fd, "%s\n", file);
+
+ case FTW_D:
+ /*
+ * Unowned user check.
+ */
+ u_nss_data = getpwuid(sb->st_uid);
+ if (u_nss_data == NULL)
+ fprintf(unowned_user_fd, "%s\n", file);
+
+ /*
+ * Unowned group check.
+ */
+ g_nss_data = getgrgid(sb->st_uid);
+ if (g_nss_data == NULL)
+ fprintf(unowned_group_fd, "%s\n", file);
+ break;
+ }
+ return 0;
+}
+
+/* This function opens all log files */
+__inline__ static void init()
+{
+ static const char *mode = "w+";
+
+ suid_fd = fopen(getenv("SUID_ROOT_TODAY"), mode);
+ if ( ! suid_fd ) {
+ perror("fopen (suid_root_today)");
+ exit(1);
+ }
+
+ sgid_fd = fopen(getenv("SUID_GROUP_TODAY"), mode);
+ if ( ! sgid_fd ) {
+ perror("fopen (suid_group_today)");
+ exit(1);
+ }
+
+ writeable_fd = fopen(getenv("WRITEABLE_TODAY"), mode);
+ if ( ! writeable_fd ) {
+ perror("fopen (writeable_today)");
+ exit(1);
+ }
+
+ unowned_user_fd = fopen(getenv("UNOWNED_USER_TODAY"), mode);
+ if ( ! unowned_user_fd ) {
+ perror("fopen (unowned_user_today)");
+ exit(1);
+ }
+
+ unowned_group_fd = fopen(getenv("UNOWNED_GROUP_TODAY"), mode);
+ if ( ! unowned_group_fd ) {
+ perror("fopen (unowned_group_today)");
+ exit(1);
+ }
+}
+
+int main(int argc, char **argv)
+{
+ char *directory;
+ int res = 0, i;
+ int ctrl = 0;
+
+ if ( argc < 2 ) {
+ fprintf(stderr, "Please give directory as argument.\n");
+ fprintf(stderr, "%s /usr/sbin /sbin\n\n", argv[0]);
+ exit(1);
+ }
+
+ /* open all log files */
+ init();
+
+ for ( i = 0; i < argc; i++ ) {
+
+ if (strcmp(argv[0], "/") != 0) {
+ /*
+ * We need to add a final '/' to the base directory name else the
+ * FTW_MOUNT option of nftw won't work. i.e. : /mnt/cdrom is on the /
+ * fs (it is the directory on which a CD is mounted) whereas
+ * /mnt/cdrom/ is the mounted directory.
+ * Hopefully, find has the same "bug"
+ */
+
+ ctrl = 1;
+ directory = ( char * ) malloc((strlen(argv[i]) + 1));
+ if ( ! directory ) {
+ perror("malloc");
+ exit(1);
+ }
+
+ strcpy(directory, argv[i]);
+ strcat(directory, "/");
+ } else directory = argv[i];
+
+ res = nftw(directory, traverse, (int) 500, FTW_PHYS | FTW_MOUNT | FTW_CHDIR);
+ if ( ctrl ) {
+ free(directory);
+ ctrl = 0;
+ }
+ }
+
+ /*
+ * close all log files
+ */
+
+ fclose(suid_fd);
+ fclose(sgid_fd);
+ fclose(writeable_fd);
+ fclose(unowned_user_fd);
+ fclose(unowned_group_fd);
+
+ exit(res);
+}
+
+
+
+
+
+
+