pure-ftpd-apparmor.patch

   1 diff -ur pure-ftpd-1.0.49.org/config.h.in pure-ftpd-1.0.49/config.h.in
   2 --- pure-ftpd-1.0.49.org/config.h.in    2019-03-25 18:00:47.000000000 +0100
   3 +++ pure-ftpd-1.0.49/config.h.in        2019-06-10 11:13:52.181133752 +0200
   4 @@ -3,6 +3,9 @@
   5  /* Define if building universal (internal helper macro) */
   6  #undef AC_APPLE_UNIVERSAL_BUILD
   7
   8 +/* with apparmor */
   9 +#undef APPARMOR
  10 +
  11  /* display only boring messages */
  12  #undef BORING_MODE
  13
  14 diff -ur pure-ftpd-1.0.49.org/configure.ac pure-ftpd-1.0.49/configure.ac
  15 --- pure-ftpd-1.0.49.org/configure.ac   2019-04-03 12:41:30.000000000 +0200
  16 +++ pure-ftpd-1.0.49/configure.ac       2019-06-10 11:13:52.181133752 +0200
  17 @@ -790,6 +790,13 @@
  18      AC_DEFINE(QUOTAS,,[with quotas])
  19    fi ])
  20
  21 +AC_ARG_WITH(apparmor,
  22 +[AS_HELP_STRING(--with-apparmorquotas,Support changing Apparmor Hats)],
  23 +[ if test "x$withval" = "xyes" ; then
  24 +    AC_DEFINE(APPARMOR,,[with apparmor])
  25 +    LIBS="$LIBS -lapparmor"
  26 +  fi ])
  27 +
  28  AC_ARG_WITH(ftpwho,
  29  [AS_HELP_STRING(--with-ftpwho,Support for pure-ftpwho)],
  30  [ if test "x$withval" = "xyes" ; then
  31 Only in pure-ftpd-1.0.49: configure.ac.orig
  32 diff -ur pure-ftpd-1.0.49.org/pureftpd-mysql.conf pure-ftpd-1.0.49/pureftpd-mysql.conf
  33 --- pure-ftpd-1.0.49.org/pureftpd-mysql.conf    2019-06-10 11:13:16.120061167 +0200
  34 +++ pure-ftpd-1.0.49/pureftpd-mysql.conf        2019-06-10 11:13:52.181133752 +0200
  35 @@ -112,6 +112,9 @@
  36  # MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User='\L'
  37
  38
  39 +# Optional : Apparmor Hat to use.
  40 +# MYSQLGetApparmorHat SELECT hat FROM users WHERE User='\L'
  41 +
  42  # Enable ~ expansion. NEVER ENABLE THIS BLINDLY UNLESS :
  43  # 1) You know what you are doing.
  44  # 2) Real and virtual users match.
  45 diff -ur pure-ftpd-1.0.49.org/README.Authentication-Modules pure-ftpd-1.0.49/README.Authentication-Modules
  46 --- pure-ftpd-1.0.49.org/README.Authentication-Modules  2019-03-25 18:10:06.000000000 +0100
  47 +++ pure-ftpd-1.0.49/README.Authentication-Modules      2019-06-10 11:17:27.140847844 +0200
  48 @@ -118,6 +118,9 @@
  49
  50  The maximal authorized number of concurrent sessions.
  51
  52 +* apparmor_hat:xxx (optional)
  53 +
  54 +Apparmor HAT name.
  55
  56            ------------------------ EXAMPLE ------------------------
  57
  58 diff -ur pure-ftpd-1.0.49.org/src/ftpd.c pure-ftpd-1.0.49/src/ftpd.c
  59 --- pure-ftpd-1.0.49.org/src/ftpd.c     2019-06-10 11:13:16.123394599 +0200
  60 +++ pure-ftpd-1.0.49/src/ftpd.c 2019-06-10 11:13:52.184467185 +0200
  61 @@ -18,6 +18,9 @@
  62  #ifdef QUOTAS
  63  # include "quotas.h"
  64  #endif
  65 +#ifdef APPARMOR
  66 +# include <sys/apparmor.h>
  67 +#endif
  68  #ifdef WITH_DIRALIASES
  69  # include "diraliases.h"
  70  #endif
  71 @@ -1516,6 +1519,9 @@
  72          result.ratio_download = ratio_download;
  73          result.ratio_ul_changed = result.ratio_dl_changed = 0;
  74  #endif
  75 +#ifdef APPARMOR
  76 +        result.apparmor_hat = NULL;
  77 +#endif
  78  #ifdef PER_USER_LIMITS
  79          result.per_user_max = per_user_max;
  80  #endif
  81 @@ -1944,6 +1950,16 @@
  82  # endif
  83      enablesignals();
  84  #endif
  85 +
  86 +#ifdef APPARMOR
  87 +    if (authresult.apparmor_hat != NULL) {
  88 +        if (change_hat(authresult.apparmor_hat, zrand()) < 0)
  89 +            die(421, LOG_ERR, MSG_CHROOT_FAILED);
  90 +        logfile(LOG_INFO, MSG_APPARMOR_HAT, account, authresult.apparmor_hat);
  91 +        free(authresult.apparmor_hat);
  92 +    }
  93 +#endif
  94 +
  95      logfile(LOG_INFO, MSG_IS_NOW_LOGGED_IN, account);
  96  #ifdef FTPWHO
  97      if (shm_data_cur != NULL) {
  98 diff -ur pure-ftpd-1.0.49.org/src/ftpd.h pure-ftpd-1.0.49/src/ftpd.h
  99 --- pure-ftpd-1.0.49.org/src/ftpd.h     2019-06-10 11:13:16.123394599 +0200
 100 +++ pure-ftpd-1.0.49/src/ftpd.h 2019-06-10 11:13:52.184467185 +0200
 101 @@ -291,6 +291,9 @@
 102  #ifdef PER_USER_LIMITS
 103      unsigned int per_user_max;
 104  #endif
 105 +#ifdef APPARMOR
 106 +    const char *apparmor_hat;
 107 +#endif
 108  } AuthResult;
 109
 110  typedef struct PureFileInfo_ {
 111 diff -ur pure-ftpd-1.0.49.org/src/log_extauth.c pure-ftpd-1.0.49/src/log_extauth.c
 112 --- pure-ftpd-1.0.49.org/src/log_extauth.c      2019-04-03 12:38:36.000000000 +0200
 113 +++ pure-ftpd-1.0.49/src/log_extauth.c  2019-06-10 11:15:54.581435088 +0200
 114 @@ -145,6 +145,19 @@
 115  #endif
 116  }
 117
 118 +static void callback_reply_apparmor_hat(const char *str, AuthResult * const result)
 119 +{
 120 +#ifdef APPARMOR
 121 +    if (*str) {
 122 +        free((void *) (result->apparmor_hat));
 123 +        result->apparmor_hat = strdup(str);
 124 +    }
 125 +#else
 126 +    (void) str;
 127 +    (void) result;
 128 +#endif
 129 +}
 130 +
 131  static void callback_reply_end(const char *str, AuthResult * const result)
 132  {
 133      (void) str;
 134 @@ -221,6 +234,9 @@
 135      result->uid = (uid_t) 0;
 136      result->gid = (gid_t) 0;
 137      result->dir = NULL;
 138 +#ifdef APPARMOR
 139 +    result->apparmor_hat = NULL;
 140 +#endif
 141      result->slow_tilde_expansion = 1;
 142      auth_finalized = 0;
 143      if ((readnb = safe_read(kindy, line, sizeof line - 1U)) <= (ssize_t) 0) {
 144 diff -ur pure-ftpd-1.0.49.org/src/log_extauth.h pure-ftpd-1.0.49/src/log_extauth.h
 145 --- pure-ftpd-1.0.49.org/src/log_extauth.h      2019-03-25 18:11:33.000000000 +0100
 146 +++ pure-ftpd-1.0.49/src/log_extauth.h  2019-06-10 11:14:18.448581707 +0200
 147 @@ -35,6 +35,7 @@
 148  #define EXTAUTH_REPLY_RATIO_UPLOAD "ratio_upload" EXTAUTH_KEYWORD_SEP
 149  #define EXTAUTH_REPLY_RATIO_DOWNLOAD "ratio_download" EXTAUTH_KEYWORD_SEP
 150  #define EXTAUTH_REPLY_PER_USER_MAX "per_user_max" EXTAUTH_KEYWORD_SEP
 151 +#define EXTAUTH_REPLY_APPARMOR_HAT "apparmor_hat" EXTAUTH_KEYWORD_SEP
 152  #define EXTAUTH_REPLY_END "end"
 153
 154  #endif
 155 diff -ur pure-ftpd-1.0.49.org/src/log_extauth_p.h pure-ftpd-1.0.49/src/log_extauth_p.h
 156 --- pure-ftpd-1.0.49.org/src/log_extauth_p.h    2018-09-19 23:53:06.000000000 +0200
 157 +++ pure-ftpd-1.0.49/src/log_extauth_p.h        2019-06-10 11:15:04.449947766 +0200
 158 @@ -34,6 +34,7 @@
 159  static void callback_reply_ratio_upload(const char *str, AuthResult * const result);
 160  static void callback_reply_ratio_download(const char *str, AuthResult * const result);
 161  static void callback_reply_per_user_max(const char *str, AuthResult * const result);
 162 +static void callback_reply_apparmor_hat(const char *str, AuthResult * const result);
 163  static void callback_reply_end(const char *str, AuthResult * const result);
 164
 165  static ExtauthCallBack extauth_callbacks[] = {
 166 @@ -49,6 +50,7 @@
 167      { EXTAUTH_REPLY_RATIO_UPLOAD, callback_reply_ratio_upload },
 168      { EXTAUTH_REPLY_RATIO_DOWNLOAD, callback_reply_ratio_download },
 169      { EXTAUTH_REPLY_PER_USER_MAX, callback_reply_per_user_max },
 170 +    { EXTAUTH_REPLY_APPARMOR_HAT, callback_reply_apparmor_hat },
 171      { EXTAUTH_REPLY_END, callback_reply_end },
 172      { NULL, callback_reply_end }
 173  };
 174 diff -ur pure-ftpd-1.0.49.org/src/log_ldap.c pure-ftpd-1.0.49/src/log_ldap.c
 175 --- pure-ftpd-1.0.49.org/src/log_ldap.c 2019-04-02 16:00:40.000000000 +0200
 176 +++ pure-ftpd-1.0.49/src/log_ldap.c     2019-06-10 11:13:52.184467185 +0200
 177 @@ -635,6 +635,9 @@
 178      if ((result->dir = strdup(pw->pw_dir)) == NULL) {
 179          return;
 180      }
 181 +#ifdef APPARMOR
 182 +    result->apparmor_hat = NULL;
 183 +#endif
 184      result->slow_tilde_expansion = 1;
 185      result->auth_ok = 1;            /* User found, authentication ok */
 186  }
 187 diff -ur pure-ftpd-1.0.49.org/src/log_mysql.c pure-ftpd-1.0.49/src/log_mysql.c
 188 --- pure-ftpd-1.0.49.org/src/log_mysql.c        2019-06-10 11:13:16.126728032 +0200
 189 +++ pure-ftpd-1.0.49/src/log_mysql.c    2019-06-10 11:13:52.184467185 +0200
 190 @@ -332,6 +332,9 @@
 191      const char *bandwidth_ul = NULL;   /* stored bandwidth UL */
 192      const char *bandwidth_dl = NULL;   /* stored bandwidth DL */
 193  #endif
 194 +#ifdef APPARMOR
 195 +    const char *apparmor_hat = NULL;    /* Apparmor hat name */
 196 +#endif
 197      char *escaped_account = NULL;
 198      char *escaped_ip = NULL;
 199      char *escaped_port = NULL;
 200 @@ -620,6 +623,15 @@
 201          }
 202      }
 203  #endif
 204 +#ifdef APPARMOR
 205 +    if ((apparmor_hat = pw_mysql_getquery(id_sql_server, sqlreq_getapparmor_hat,
 206 +                                          escaped_account, escaped_ip,
 207 +                                          escaped_port, escaped_peer_ip,
 208 +                                          escaped_decimal_ip)) != NULL) {
 209 +        result->apparmor_hat = apparmor_hat;
 210 +        apparmor_hat = NULL;
 211 +    }
 212 +#endif
 213      result->slow_tilde_expansion = !tildexp;
 214      result->auth_ok = -result->auth_ok;
 215      bye:
 216 @@ -649,6 +661,9 @@
 217      free((void *) bandwidth_ul);
 218      free((void *) bandwidth_dl);
 219  #endif
 220 +#ifdef APPARMOR
 221 +    free((void *) apparmor_hat);
 222 +#endif
 223      free((void *) escaped_account);
 224      free((void *) escaped_ip);
 225      free((void *) escaped_port);
 226 @@ -717,6 +732,9 @@
 227      ZFREE(sqlreq_getbandwidth_ul);
 228      ZFREE(sqlreq_getbandwidth_dl);
 229  #endif
 230 +#ifdef APPARMOR
 231 +    ZFREE(sqlreq_getapparmor_hat);
 232 +#endif
 233  }
 234  #else
 235  extern signed char v6ready;
 236 diff -ur pure-ftpd-1.0.49.org/src/log_mysql_p.h pure-ftpd-1.0.49/src/log_mysql_p.h
 237 --- pure-ftpd-1.0.49.org/src/log_mysql_p.h      2018-09-19 23:53:06.000000000 +0200
 238 +++ pure-ftpd-1.0.49/src/log_mysql_p.h  2019-06-10 11:13:52.184467185 +0200
 239 @@ -38,6 +38,9 @@
 240  static char *sqlreq_getbandwidth_ul;
 241  static char *sqlreq_getbandwidth_dl;
 242  #endif
 243 +#ifdef APPARMOR
 244 +static char *sqlreq_getapparmor_hat;
 245 +#endif
 246  static signed char server_down;
 247
 248  static ConfigKeywords mysql_config_keywords[] = {
 249 @@ -68,6 +71,9 @@
 250      { "MYSQLGetBandwidthUL", &sqlreq_getbandwidth_ul },
 251      { "MYSQLGetBandwidthDL", &sqlreq_getbandwidth_dl },
 252  #endif
 253 +#ifdef APPARMOR
 254 +    { "MYSQLGetApparmorHat", &sqlreq_getapparmor_hat },
 255 +#endif
 256      { NULL, NULL }
 257  };
 258
 259 diff -ur pure-ftpd-1.0.49.org/src/log_pam.c pure-ftpd-1.0.49/src/log_pam.c
 260 --- pure-ftpd-1.0.49.org/src/log_pam.c  2019-04-02 16:00:40.000000000 +0200
 261 +++ pure-ftpd-1.0.49/src/log_pam.c      2019-06-10 11:13:52.184467185 +0200
 262 @@ -202,6 +202,9 @@
 263      (void) pam_close_session(pamh, PAM_SILENT);   /* It doesn't matter if it fails */
 264  #endif
 265      result->dir = dir;
 266 +#ifdef APPARMOR
 267 +    result->apparmor_hat = NULL;
 268 +#endif
 269      dir = NULL;
 270      result->uid = pw.pw_uid;
 271      result->gid = pw.pw_gid;
 272 diff -ur pure-ftpd-1.0.49.org/src/log_pgsql.c pure-ftpd-1.0.49/src/log_pgsql.c
 273 --- pure-ftpd-1.0.49.org/src/log_pgsql.c        2019-06-10 11:13:16.120061167 +0200
 274 +++ pure-ftpd-1.0.49/src/log_pgsql.c    2019-06-10 11:13:52.184467185 +0200
 275 @@ -402,6 +402,9 @@
 276      const char *bandwidth_ul = NULL;   /* stored bandwidth UL */
 277      const char *bandwidth_dl = NULL;   /* stored bandwidth DL */
 278  #endif
 279 +#ifdef APPARMOR
 280 +    const char *apparmor_hat = NULL;   /* Apparmor hat name */
 281 +#endif
 282      char *escaped_account = NULL;
 283      char *escaped_ip = NULL;
 284      char *escaped_port = NULL;
 285 @@ -662,6 +665,15 @@
 286          }
 287      }
 288  #endif
 289 +#ifdef APPARMOR
 290 +    if ((apparmor_hat = pw_pgsql_getquery(id_sql_server, sqlreq_getapparmor_hat,
 291 +                escaped_account, escaped_ip,
 292 +                escaped_port, escaped_peer_ip,
 293 +                escaped_decimal_ip)) != NULL) {
 294 +        result->apparmor_hat = apparmor_hat;
 295 +        apparmor_hat = NULL;
 296 +    }
 297 +#endif
 298      result->slow_tilde_expansion = 1;
 299      result->auth_ok = -result->auth_ok;
 300      bye:
 301 @@ -692,6 +704,9 @@
 302      free((void *) bandwidth_ul);
 303      free((void *) bandwidth_dl);
 304  #endif
 305 +#ifdef APPARMOR
 306 +    free((void *) apparmor_hat);
 307 +#endif
 308      free((void *) escaped_account);
 309      free((void *) escaped_ip);
 310      free((void *) escaped_port);
 311 @@ -746,6 +761,9 @@
 312      ZFREE(sqlreq_getbandwidth_ul);
 313      ZFREE(sqlreq_getbandwidth_dl);
 314  #endif
 315 +#ifdef APPARMOR
 316 +    ZFREE(sqlreq_getapparmor_hat);
 317 +#endif
 318  }
 319  #else
 320  extern signed char v6ready;
 321 diff -ur pure-ftpd-1.0.49.org/src/log_pgsql_p.h pure-ftpd-1.0.49/src/log_pgsql_p.h
 322 --- pure-ftpd-1.0.49.org/src/log_pgsql_p.h      2018-09-19 23:53:06.000000000 +0200
 323 +++ pure-ftpd-1.0.49/src/log_pgsql_p.h  2019-06-10 11:13:52.184467185 +0200
 324 @@ -28,6 +28,9 @@
 325  static char *sqlreq_getbandwidth_ul;
 326  static char *sqlreq_getbandwidth_dl;
 327  #endif
 328 +#ifdef APPARMOR
 329 +static char *sqlreq_getapparmor_hat;
 330 +#endif
 331  static signed char server_down;
 332
 333  static ConfigKeywords pgsql_config_keywords[] = {
 334 @@ -55,6 +58,9 @@
 335      { "PGSQLGetBandwidthUL", &sqlreq_getbandwidth_ul },
 336      { "PGSQLGetBandwidthDL", &sqlreq_getbandwidth_dl },
 337  #endif
 338 +#ifdef APPARMOR
 339 +    { "PGSQLGetApparmorHat", &sqlreq_getapparmor_hat },
 340 +#endif
 341      { NULL, NULL }
 342  };
 343
 344 diff -ur pure-ftpd-1.0.49.org/src/log_puredb.c pure-ftpd-1.0.49/src/log_puredb.c
 345 --- pure-ftpd-1.0.49.org/src/log_puredb.c       2019-04-02 16:00:40.000000000 +0200
 346 +++ pure-ftpd-1.0.49/src/log_puredb.c   2019-06-10 11:13:52.187800617 +0200
 347 @@ -335,6 +335,9 @@
 348          result->user_quota_size = strtoull(line, NULL, 10);
 349      }
 350  #endif
 351 +#ifdef APPARMOR
 352 +    result->apparmor_hat = NULL;
 353 +#endif
 354      if ((line = my_strtok2(NULL, *PW_LINE_SEP)) == NULL) {   /* allowed local ip */
 355          return 0;
 356      }
 357 diff -ur pure-ftpd-1.0.49.org/src/log_unix.c pure-ftpd-1.0.49/src/log_unix.c
 358 --- pure-ftpd-1.0.49.org/src/log_unix.c 2019-04-02 16:00:40.000000000 +0200
 359 +++ pure-ftpd-1.0.49/src/log_unix.c     2019-06-10 11:13:52.187800617 +0200
 360 @@ -87,6 +87,9 @@
 361      result->uid = pw.pw_uid;
 362      result->gid = pw.pw_gid;
 363      result->dir = dir;
 364 +#ifdef APPARMOR
 365 +    result->apparmor_hat = NULL;
 366 +#endif
 367      result->slow_tilde_expansion = 0;
 368      result->auth_ok = -result->auth_ok;
 369      return;
 370 diff -ur pure-ftpd-1.0.49.org/src/Makefile.am pure-ftpd-1.0.49/src/Makefile.am
 371 --- pure-ftpd-1.0.49.org/src/Makefile.am        2019-03-25 16:48:42.000000000 +0100
 372 +++ pure-ftpd-1.0.49/src/Makefile.am    2019-06-10 11:13:52.187800617 +0200
 373 @@ -143,6 +143,7 @@
 374  pure_ftpd_LDADD = \
 375         libpureftpd.a \
 376         ../puredb/src/libpuredb_read.a \
 377 +       -lapparmor \
 378         @LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@
 379
 380  pure_ftpd_SOURCES = \
 381 diff -ur pure-ftpd-1.0.49.org/src/messages_en.h pure-ftpd-1.0.49/src/messages_en.h
 382 --- pure-ftpd-1.0.49.org/src/messages_en.h      2019-06-10 11:13:16.126728032 +0200
 383 +++ pure-ftpd-1.0.49/src/messages_en.h  2019-06-10 11:13:52.187800617 +0200
 384 @@ -57,6 +57,7 @@
 385  #define MSG_CURRENT_DIR_IS "OK. Current directory is %s"
 386  #define MSG_CURRENT_RESTRICTED_DIR_IS "OK. Current restricted directory is %s"
 387  #define MSG_IS_NOW_LOGGED_IN "%s is now logged in"
 388 +#define MSG_APPARMOR_HAT "User %s apparmor hat is %s"
 389  #define MSG_CANT_CHANGE_DIR "Can't change directory to %s"
 390  #define MSG_PATH_TOO_LONG "Path too long"
 391  #define MSG_CANT_PASV "You cannot use PASV on IPv6 connections. Use EPSV instead."