From 3e8ab05f9cc05cc9b7059e0aead5823dbcd2b9f2 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivano@gnu.org>
Date: Fri, 1 May 2009 23:50:11 +0200
Subject: [PATCH] * src/chroot.c (main): Added possibility to specify the user and group
 to setgid/setuid inside the chroot.

---
 src/chroot.c |  126 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 files changed, 123 insertions(+), 3 deletions(-)

diff --git a/src/chroot.c b/src/chroot.c
index 6d3fddf..9425c21 100644
--- a/src/chroot.c
+++ b/src/chroot.c
@@ -21,17 +21,87 @@
 #include <getopt.h>
 #include <stdio.h>
 #include <sys/types.h>
+#include <grp.h>
 
 #include "system.h"
 #include "error.h"
 #include "long-options.h"
+#include "userspec.h"
 #include "quote.h"
+#include "xstrtol.h"
+
+#ifndef UID_T_MAX
+# define UID_T_MAX TYPE_MAXIMUM (uid_t)
+#endif
+
+#ifndef GID_T_MAX
+# define GID_T_MAX TYPE_MAXIMUM (gid_t)
+#endif
+
+/* MAXUID may come from limits.h or sys/params.h.  */
+#ifndef MAXUID
+# define MAXUID UID_T_MAX
+#endif
+#ifndef MAXGID
+# define MAXGID GID_T_MAX
+#endif
+
 
 /* The official name of this program (e.g., no `g' prefix).  */
 #define PROGRAM_NAME "chroot"
 
 #define AUTHORS proper_name ("Roland McGrath")
 
+
+static struct option const long_opts[] =
+{
+  {"userspec", required_argument, NULL, 'u'},
+  {"groups", required_argument, NULL, 'g'},
+  {GETOPT_HELP_OPTION_DECL},
+  {GETOPT_VERSION_OPTION_DECL},
+  {NULL, 0, NULL, 0}
+};
+
+/* Groups is a comma separated list of additional groups.  */
+static int set_additional_groups (const char *groups)
+{
+  gid_t groups_id [NGROUPS];
+  int ngroups = 0;
+  char *buffer = xstrdup (groups);
+  const char *tmp;
+
+  for (tmp = strtok (buffer, ","); tmp; tmp = strtok (NULL, ","))
+    {
+      struct group *g;
+      unsigned long int value;
+
+      if (xstrtoul (tmp, NULL, 10, &value, "") == LONGINT_OK && value <= MAXGID)
+        {
+          g = getgrgid (value);
+        }
+      else
+        {
+          g = getgrnam (tmp);
+          if (g != NULL)
+            value = g->gr_gid;
+        }
+
+      if (g == NULL)
+        {
+          error (0, errno, _("cannot find group %s"), tmp);
+          free (buffer);
+          return 1;
+        }
+
+      groups_id[ngroups++] = value;
+    }
+
+  free (buffer);
+
+  return setgroups (ngroups, groups_id);
+}
+
+
 void
 usage (int status)
 {
@@ -41,13 +111,20 @@ usage (int status)
   else
     {
       printf (_("\
-Usage: %s NEWROOT [COMMAND [ARG]...]\n\
+Usage: %s [OPTION] NEWROOT [COMMAND [ARG]...]\n\
   or:  %s OPTION\n\
 "), program_name, program_name);
+
       fputs (_("\
 Run COMMAND with root directory set to NEWROOT.\n\
 \n\
 "), stdout);
+
+      fputs (_("\
+  -u, --userspec specify the userspec in the form USER:GROUP\n\
+  -g, --groups   specify the additional groups as g1,g2,..,gn\n\
+"), stdout);
+
       fputs (HELP_OPTION_DESCRIPTION, stdout);
       fputs (VERSION_OPTION_DESCRIPTION, stdout);
       fputs (_("\
@@ -62,6 +139,10 @@ If no command is given, run ``${SHELL} -i'' (default: /bin/sh).\n\
 int
 main (int argc, char **argv)
 {
+  int c;
+  const char *userspec = NULL;
+  const char *groups = NULL;
+
   initialize_main (&argc, &argv);
   set_program_name (argv[0]);
   setlocale (LC_ALL, "");
@@ -73,8 +154,14 @@ main (int argc, char **argv)
 
   parse_long_options (argc, argv, PROGRAM_NAME, PACKAGE_NAME, Version,
 		      usage, AUTHORS, (char const *) NULL);
-  if (getopt_long (argc, argv, "+", NULL, NULL) != -1)
-    usage (EXIT_FAILURE);
+
+  while ((c = getopt_long (argc, argv, "+u:g:", long_opts, NULL))	 != -1)
+    {
+      if (c == 'u')
+        userspec = optarg;
+      else if (c == 'g')
+        groups = optarg;
+    }
 
   if (argc <= optind)
     {
@@ -105,6 +192,39 @@ main (int argc, char **argv)
       argv += optind + 1;
     }
 
+  if (userspec)
+    {
+      uid_t uid;
+      gid_t gid;
+      char *user;
+      char *group;
+      const char *err = parse_user_spec (userspec, &uid, &gid, &user, &group);
+      if (err)
+        {
+          perror (err);
+          exit (1);
+        }
+
+      free (user);
+      free (group);
+
+      if (groups)
+        {
+          if (set_additional_groups (groups))
+            error (0, errno, _("cannot set additional groups"));
+        }
+
+      if (gid && setgid (gid))
+        {
+          error (0, errno, _("cannot setgid"));
+        }
+
+      if (uid && setuid (uid))
+        {
+          error (0, errno, _("cannot setgid"));
+        }
+    }
+
   /* Execute the given command.  */
   execvp (argv[0], argv);
 
-- 
1.6.2.4

