pure-ftpd-apparmor.patch

   1 diff -ur pure-ftpd-1.0.49.org/config.h.in pure-ftpd-1.0.49/config.h.in
   2 --- pure-ftpd-1.0.49.org/config.h.in    2019-03-25 18:00:47.000000000 +0100
   3 +++ pure-ftpd-1.0.49/config.h.in        2023-06-27 13:52:05.846355280 +0200
   4 @@ -3,6 +3,9 @@
   5  /* Define if building universal (internal helper macro) */
   6  #undef AC_APPLE_UNIVERSAL_BUILD
   7
   8 +/* with apparmor */
   9 +#undef APPARMOR
  10 +
  11  /* display only boring messages */
  12  #undef BORING_MODE
  13
  14 diff -ur pure-ftpd-1.0.49.org/configure.ac pure-ftpd-1.0.49/configure.ac
  15 --- pure-ftpd-1.0.49.org/configure.ac   2019-04-03 12:41:30.000000000 +0200
  16 +++ pure-ftpd-1.0.49/configure.ac       2023-06-27 13:52:05.849688614 +0200
  17 @@ -790,6 +790,13 @@
  18      AC_DEFINE(QUOTAS,,[with quotas])
  19    fi ])
  20
  21 +AC_ARG_WITH(apparmor,
  22 +[AS_HELP_STRING(--with-apparmorquotas,Support changing Apparmor Hats)],
  23 +[ if test "x$withval" = "xyes" ; then
  24 +    AC_DEFINE(APPARMOR,,[with apparmor])
  25 +    LIBS="$LIBS -lapparmor"
  26 +  fi ])
  27 +
  28  AC_ARG_WITH(ftpwho,
  29  [AS_HELP_STRING(--with-ftpwho,Support for pure-ftpwho)],
  30  [ if test "x$withval" = "xyes" ; then
  31 diff -ur pure-ftpd-1.0.49.org/pureftpd-mysql.conf pure-ftpd-1.0.49/pureftpd-mysql.conf
  32 --- pure-ftpd-1.0.49.org/pureftpd-mysql.conf    2018-01-04 13:13:36.000000000 +0100
  33 +++ pure-ftpd-1.0.49/pureftpd-mysql.conf        2023-06-27 13:52:05.849688614 +0200
  34 @@ -112,6 +112,9 @@
  35  # MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User='\L'
  36
  37
  38 +# Optional : Apparmor Hat to use.
  39 +# MYSQLGetApparmorHat SELECT hat FROM users WHERE User='\L'
  40 +
  41  # Enable ~ expansion. NEVER ENABLE THIS BLINDLY UNLESS :
  42  # 1) You know what you are doing.
  43  # 2) Real and virtual users match.
  44 diff -ur pure-ftpd-1.0.49.org/README.Authentication-Modules pure-ftpd-1.0.49/README.Authentication-Modules
  45 --- pure-ftpd-1.0.49.org/README.Authentication-Modules  2019-03-25 18:10:06.000000000 +0100
  46 +++ pure-ftpd-1.0.49/README.Authentication-Modules      2023-06-27 13:52:05.849688614 +0200
  47 @@ -118,6 +118,9 @@
  48
  49  The maximal authorized number of concurrent sessions.
  50
  51 +* apparmor_hat:xxx (optional)
  52 +
  53 +Apparmor HAT name.
  54
  55            ------------------------ EXAMPLE ------------------------
  56
  57 diff -ur pure-ftpd-1.0.49.org/src/ftpd.c pure-ftpd-1.0.49/src/ftpd.c
  58 --- pure-ftpd-1.0.49.org/src/ftpd.c     2019-04-02 16:00:40.000000000 +0200
  59 +++ pure-ftpd-1.0.49/src/ftpd.c 2023-06-27 13:52:26.496355278 +0200
  60 @@ -18,6 +18,9 @@
  61  #ifdef QUOTAS
  62  # include "quotas.h"
  63  #endif
  64 +#ifdef APPARMOR
  65 +# include <sys/apparmor.h>
  66 +#endif
  67  #ifdef WITH_DIRALIASES
  68  # include "diraliases.h"
  69  #endif
  70 @@ -1516,6 +1519,9 @@
  71          result.ratio_download = ratio_download;
  72          result.ratio_ul_changed = result.ratio_dl_changed = 0;
  73  #endif
  74 +#ifdef APPARMOR
  75 +        result.apparmor_hat = NULL;
  76 +#endif
  77  #ifdef PER_USER_LIMITS
  78          result.per_user_max = per_user_max;
  79  #endif
  80 @@ -1944,6 +1950,16 @@
  81  # endif
  82      enablesignals();
  83  #endif
  84 +
  85 +#ifdef APPARMOR
  86 +    if (authresult.apparmor_hat != NULL) {
  87 +        logfile(LOG_INFO, MSG_APPARMOR_HAT, account, authresult.apparmor_hat);
  88 +        if (change_hat(authresult.apparmor_hat, zrand()) < 0)
  89 +            die(421, LOG_ERR, MSG_APPARMOR_FAILED);
  90 +        free(authresult.apparmor_hat);
  91 +    }
  92 +#endif
  93 +
  94      logfile(LOG_INFO, MSG_IS_NOW_LOGGED_IN, account);
  95  #ifdef FTPWHO
  96      if (shm_data_cur != NULL) {
  97 diff -ur pure-ftpd-1.0.49.org/src/ftpd.h pure-ftpd-1.0.49/src/ftpd.h
  98 --- pure-ftpd-1.0.49.org/src/ftpd.h     2019-03-25 16:48:42.000000000 +0100
  99 +++ pure-ftpd-1.0.49/src/ftpd.h 2023-06-27 13:52:05.849688614 +0200
 100 @@ -291,6 +291,9 @@
 101  #ifdef PER_USER_LIMITS
 102      unsigned int per_user_max;
 103  #endif
 104 +#ifdef APPARMOR
 105 +    const char *apparmor_hat;
 106 +#endif
 107  } AuthResult;
 108
 109  typedef struct PureFileInfo_ {
 110 diff -ur pure-ftpd-1.0.49.org/src/log_extauth.c pure-ftpd-1.0.49/src/log_extauth.c
 111 --- pure-ftpd-1.0.49.org/src/log_extauth.c      2019-04-03 12:38:36.000000000 +0200
 112 +++ pure-ftpd-1.0.49/src/log_extauth.c  2023-06-27 13:52:05.849688614 +0200
 113 @@ -145,6 +145,19 @@
 114  #endif
 115  }
 116
 117 +static void callback_reply_apparmor_hat(const char *str, AuthResult * const result)
 118 +{
 119 +#ifdef APPARMOR
 120 +    if (*str) {
 121 +        free((void *) (result->apparmor_hat));
 122 +        result->apparmor_hat = strdup(str);
 123 +    }
 124 +#else
 125 +    (void) str;
 126 +    (void) result;
 127 +#endif
 128 +}
 129 +
 130  static void callback_reply_end(const char *str, AuthResult * const result)
 131  {
 132      (void) str;
 133 @@ -221,6 +234,9 @@
 134      result->uid = (uid_t) 0;
 135      result->gid = (gid_t) 0;
 136      result->dir = NULL;
 137 +#ifdef APPARMOR
 138 +    result->apparmor_hat = NULL;
 139 +#endif
 140      result->slow_tilde_expansion = 1;
 141      auth_finalized = 0;
 142      if ((readnb = safe_read(kindy, line, sizeof line - 1U)) <= (ssize_t) 0) {
 143 diff -ur pure-ftpd-1.0.49.org/src/log_extauth.h pure-ftpd-1.0.49/src/log_extauth.h
 144 --- pure-ftpd-1.0.49.org/src/log_extauth.h      2019-03-25 18:11:33.000000000 +0100
 145 +++ pure-ftpd-1.0.49/src/log_extauth.h  2023-06-27 13:52:05.849688614 +0200
 146 @@ -35,6 +35,7 @@
 147  #define EXTAUTH_REPLY_RATIO_UPLOAD "ratio_upload" EXTAUTH_KEYWORD_SEP
 148  #define EXTAUTH_REPLY_RATIO_DOWNLOAD "ratio_download" EXTAUTH_KEYWORD_SEP
 149  #define EXTAUTH_REPLY_PER_USER_MAX "per_user_max" EXTAUTH_KEYWORD_SEP
 150 +#define EXTAUTH_REPLY_APPARMOR_HAT "apparmor_hat" EXTAUTH_KEYWORD_SEP
 151  #define EXTAUTH_REPLY_END "end"
 152
 153  #endif
 154 diff -ur pure-ftpd-1.0.49.org/src/log_extauth_p.h pure-ftpd-1.0.49/src/log_extauth_p.h
 155 --- pure-ftpd-1.0.49.org/src/log_extauth_p.h    2018-09-19 23:53:06.000000000 +0200
 156 +++ pure-ftpd-1.0.49/src/log_extauth_p.h        2023-06-27 13:52:05.849688614 +0200
 157 @@ -34,6 +34,7 @@
 158  static void callback_reply_ratio_upload(const char *str, AuthResult * const result);
 159  static void callback_reply_ratio_download(const char *str, AuthResult * const result);
 160  static void callback_reply_per_user_max(const char *str, AuthResult * const result);
 161 +static void callback_reply_apparmor_hat(const char *str, AuthResult * const result);
 162  static void callback_reply_end(const char *str, AuthResult * const result);
 163
 164  static ExtauthCallBack extauth_callbacks[] = {
 165 @@ -49,6 +50,7 @@
 166      { EXTAUTH_REPLY_RATIO_UPLOAD, callback_reply_ratio_upload },
 167      { EXTAUTH_REPLY_RATIO_DOWNLOAD, callback_reply_ratio_download },
 168      { EXTAUTH_REPLY_PER_USER_MAX, callback_reply_per_user_max },
 169 +    { EXTAUTH_REPLY_APPARMOR_HAT, callback_reply_apparmor_hat },
 170      { EXTAUTH_REPLY_END, callback_reply_end },
 171      { NULL, callback_reply_end }
 172  };
 173 diff -ur pure-ftpd-1.0.49.org/src/log_ldap.c pure-ftpd-1.0.49/src/log_ldap.c
 174 --- pure-ftpd-1.0.49.org/src/log_ldap.c 2019-04-02 16:00:40.000000000 +0200
 175 +++ pure-ftpd-1.0.49/src/log_ldap.c     2023-06-27 13:52:05.849688614 +0200
 176 @@ -635,6 +635,9 @@
 177      if ((result->dir = strdup(pw->pw_dir)) == NULL) {
 178          return;
 179      }
 180 +#ifdef APPARMOR
 181 +    result->apparmor_hat = NULL;
 182 +#endif
 183      result->slow_tilde_expansion = 1;
 184      result->auth_ok = 1;            /* User found, authentication ok */
 185  }
 186 diff -ur pure-ftpd-1.0.49.org/src/log_mysql.c pure-ftpd-1.0.49/src/log_mysql.c
 187 --- pure-ftpd-1.0.49.org/src/log_mysql.c        2019-04-02 16:00:40.000000000 +0200
 188 +++ pure-ftpd-1.0.49/src/log_mysql.c    2023-06-27 13:52:05.853021947 +0200
 189 @@ -325,6 +325,9 @@
 190      const char *bandwidth_ul = NULL;   /* stored bandwidth UL */
 191      const char *bandwidth_dl = NULL;   /* stored bandwidth DL */
 192  #endif
 193 +#ifdef APPARMOR
 194 +    const char *apparmor_hat = NULL;    /* Apparmor hat name */
 195 +#endif
 196      char *escaped_account = NULL;
 197      char *escaped_ip = NULL;
 198      char *escaped_port = NULL;
 199 @@ -612,6 +615,15 @@
 200          }
 201      }
 202  #endif
 203 +#ifdef APPARMOR
 204 +    if ((apparmor_hat = pw_mysql_getquery(id_sql_server, sqlreq_getapparmor_hat,
 205 +                                          escaped_account, escaped_ip,
 206 +                                          escaped_port, escaped_peer_ip,
 207 +                                          escaped_decimal_ip)) != NULL) {
 208 +        result->apparmor_hat = apparmor_hat;
 209 +        apparmor_hat = NULL;
 210 +    }
 211 +#endif
 212      result->slow_tilde_expansion = !tildexp;
 213      result->auth_ok = -result->auth_ok;
 214      bye:
 215 @@ -641,6 +653,9 @@
 216      free((void *) bandwidth_ul);
 217      free((void *) bandwidth_dl);
 218  #endif
 219 +#ifdef APPARMOR
 220 +    free((void *) apparmor_hat);
 221 +#endif
 222      free((void *) escaped_account);
 223      free((void *) escaped_ip);
 224      free((void *) escaped_port);
 225 @@ -709,6 +724,9 @@
 226      ZFREE(sqlreq_getbandwidth_ul);
 227      ZFREE(sqlreq_getbandwidth_dl);
 228  #endif
 229 +#ifdef APPARMOR
 230 +    ZFREE(sqlreq_getapparmor_hat);
 231 +#endif
 232  }
 233  #else
 234  extern signed char v6ready;
 235 diff -ur pure-ftpd-1.0.49.org/src/log_mysql_p.h pure-ftpd-1.0.49/src/log_mysql_p.h
 236 --- pure-ftpd-1.0.49.org/src/log_mysql_p.h      2018-09-19 23:53:06.000000000 +0200
 237 +++ pure-ftpd-1.0.49/src/log_mysql_p.h  2023-06-27 13:52:05.853021947 +0200
 238 @@ -38,6 +38,9 @@
 239  static char *sqlreq_getbandwidth_ul;
 240  static char *sqlreq_getbandwidth_dl;
 241  #endif
 242 +#ifdef APPARMOR
 243 +static char *sqlreq_getapparmor_hat;
 244 +#endif
 245  static signed char server_down;
 246
 247  static ConfigKeywords mysql_config_keywords[] = {
 248 @@ -68,6 +71,9 @@
 249      { "MYSQLGetBandwidthUL", &sqlreq_getbandwidth_ul },
 250      { "MYSQLGetBandwidthDL", &sqlreq_getbandwidth_dl },
 251  #endif
 252 +#ifdef APPARMOR
 253 +    { "MYSQLGetApparmorHat", &sqlreq_getapparmor_hat },
 254 +#endif
 255      { NULL, NULL }
 256  };
 257
 258 diff -ur pure-ftpd-1.0.49.org/src/log_pam.c pure-ftpd-1.0.49/src/log_pam.c
 259 --- pure-ftpd-1.0.49.org/src/log_pam.c  2019-04-02 16:00:40.000000000 +0200
 260 +++ pure-ftpd-1.0.49/src/log_pam.c      2023-06-27 13:52:05.853021947 +0200
 261 @@ -202,6 +202,9 @@
 262      (void) pam_close_session(pamh, PAM_SILENT);   /* It doesn't matter if it fails */
 263  #endif
 264      result->dir = dir;
 265 +#ifdef APPARMOR
 266 +    result->apparmor_hat = NULL;
 267 +#endif
 268      dir = NULL;
 269      result->uid = pw.pw_uid;
 270      result->gid = pw.pw_gid;
 271 diff -ur pure-ftpd-1.0.49.org/src/log_pgsql.c pure-ftpd-1.0.49/src/log_pgsql.c
 272 --- pure-ftpd-1.0.49.org/src/log_pgsql.c        2019-04-02 16:00:40.000000000 +0200
 273 +++ pure-ftpd-1.0.49/src/log_pgsql.c    2023-06-27 13:52:05.853021947 +0200
 274 @@ -402,6 +402,9 @@
 275      const char *bandwidth_ul = NULL;   /* stored bandwidth UL */
 276      const char *bandwidth_dl = NULL;   /* stored bandwidth DL */
 277  #endif
 278 +#ifdef APPARMOR
 279 +    const char *apparmor_hat = NULL;   /* Apparmor hat name */
 280 +#endif
 281      char *escaped_account = NULL;
 282      char *escaped_ip = NULL;
 283      char *escaped_port = NULL;
 284 @@ -661,6 +664,15 @@
 285          }
 286      }
 287  #endif
 288 +#ifdef APPARMOR
 289 +    if ((apparmor_hat = pw_pgsql_getquery(id_sql_server, sqlreq_getapparmor_hat,
 290 +                escaped_account, escaped_ip,
 291 +                escaped_port, escaped_peer_ip,
 292 +                escaped_decimal_ip)) != NULL) {
 293 +        result->apparmor_hat = apparmor_hat;
 294 +        apparmor_hat = NULL;
 295 +    }
 296 +#endif
 297      result->slow_tilde_expansion = 1;
 298      result->auth_ok = -result->auth_ok;
 299      bye:
 300 @@ -691,6 +703,9 @@
 301      free((void *) bandwidth_ul);
 302      free((void *) bandwidth_dl);
 303  #endif
 304 +#ifdef APPARMOR
 305 +    free((void *) apparmor_hat);
 306 +#endif
 307      free((void *) escaped_account);
 308      free((void *) escaped_ip);
 309      free((void *) escaped_port);
 310 @@ -745,6 +760,9 @@
 311      ZFREE(sqlreq_getbandwidth_ul);
 312      ZFREE(sqlreq_getbandwidth_dl);
 313  #endif
 314 +#ifdef APPARMOR
 315 +    ZFREE(sqlreq_getapparmor_hat);
 316 +#endif
 317  }
 318  #else
 319  extern signed char v6ready;
 320 diff -ur pure-ftpd-1.0.49.org/src/log_pgsql_p.h pure-ftpd-1.0.49/src/log_pgsql_p.h
 321 --- pure-ftpd-1.0.49.org/src/log_pgsql_p.h      2018-09-19 23:53:06.000000000 +0200
 322 +++ pure-ftpd-1.0.49/src/log_pgsql_p.h  2023-06-27 13:52:05.853021947 +0200
 323 @@ -28,6 +28,9 @@
 324  static char *sqlreq_getbandwidth_ul;
 325  static char *sqlreq_getbandwidth_dl;
 326  #endif
 327 +#ifdef APPARMOR
 328 +static char *sqlreq_getapparmor_hat;
 329 +#endif
 330  static signed char server_down;
 331
 332  static ConfigKeywords pgsql_config_keywords[] = {
 333 @@ -55,6 +58,9 @@
 334      { "PGSQLGetBandwidthUL", &sqlreq_getbandwidth_ul },
 335      { "PGSQLGetBandwidthDL", &sqlreq_getbandwidth_dl },
 336  #endif
 337 +#ifdef APPARMOR
 338 +    { "PGSQLGetApparmorHat", &sqlreq_getapparmor_hat },
 339 +#endif
 340      { NULL, NULL }
 341  };
 342
 343 diff -ur pure-ftpd-1.0.49.org/src/log_puredb.c pure-ftpd-1.0.49/src/log_puredb.c
 344 --- pure-ftpd-1.0.49.org/src/log_puredb.c       2019-04-02 16:00:40.000000000 +0200
 345 +++ pure-ftpd-1.0.49/src/log_puredb.c   2023-06-27 13:52:05.853021947 +0200
 346 @@ -335,6 +335,9 @@
 347          result->user_quota_size = strtoull(line, NULL, 10);
 348      }
 349  #endif
 350 +#ifdef APPARMOR
 351 +    result->apparmor_hat = NULL;
 352 +#endif
 353      if ((line = my_strtok2(NULL, *PW_LINE_SEP)) == NULL) {   /* allowed local ip */
 354          return 0;
 355      }
 356 diff -ur pure-ftpd-1.0.49.org/src/log_unix.c pure-ftpd-1.0.49/src/log_unix.c
 357 --- pure-ftpd-1.0.49.org/src/log_unix.c 2019-04-02 16:00:40.000000000 +0200
 358 +++ pure-ftpd-1.0.49/src/log_unix.c     2023-06-27 13:52:05.853021947 +0200
 359 @@ -87,6 +87,9 @@
 360      result->uid = pw.pw_uid;
 361      result->gid = pw.pw_gid;
 362      result->dir = dir;
 363 +#ifdef APPARMOR
 364 +    result->apparmor_hat = NULL;
 365 +#endif
 366      result->slow_tilde_expansion = 0;
 367      result->auth_ok = -result->auth_ok;
 368      return;
 369 diff -ur pure-ftpd-1.0.49.org/src/Makefile.am pure-ftpd-1.0.49/src/Makefile.am
 370 --- pure-ftpd-1.0.49.org/src/Makefile.am        2019-03-25 16:48:42.000000000 +0100
 371 +++ pure-ftpd-1.0.49/src/Makefile.am    2023-06-27 13:52:05.853021947 +0200
 372 @@ -143,6 +143,7 @@
 373  pure_ftpd_LDADD = \
 374         libpureftpd.a \
 375         ../puredb/src/libpuredb_read.a \
 376 +       -lapparmor \
 377         @LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@
 378
 379  pure_ftpd_SOURCES = \
 380 diff -ur pure-ftpd-1.0.49.org/src/messages_en.h pure-ftpd-1.0.49/src/messages_en.h
 381 --- pure-ftpd-1.0.49.org/src/messages_en.h      2019-03-25 16:48:42.000000000 +0100
 382 +++ pure-ftpd-1.0.49/src/messages_en.h  2023-06-27 13:52:50.413021941 +0200
 383 @@ -54,9 +54,11 @@
 384  #define MSG_FXP_SUPPORT "This server supports FXP transfers"
 385  #define MSG_RATIO "You must respect a %u:%u (UL/DL) ratio"
 386  #define MSG_CHROOT_FAILED "Unable to set up a secure chroot() jail"
 387 +#define MSG_APPARMOR_FAILED "Unable to set up security policies"
 388  #define MSG_CURRENT_DIR_IS "OK. Current directory is %s"
 389  #define MSG_CURRENT_RESTRICTED_DIR_IS "OK. Current restricted directory is %s"
 390  #define MSG_IS_NOW_LOGGED_IN "%s is now logged in"
 391 +#define MSG_APPARMOR_HAT "User %s apparmor hat is %s"
 392  #define MSG_CANT_CHANGE_DIR "Can't change directory to %s"
 393  #define MSG_PATH_TOO_LONG "Path too long"
 394  #define MSG_CANT_PASV "You cannot use PASV on IPv6 connections. Use EPSV instead."