#!/usr/bin/bash
##CageFS proxyexec wrapper - ver 18
if [[ $EUID -eq 0 ]]; then
echo 'Cannot be run as root'
exit 1
fi
# POSIX single-quote escaping for values embedded in the ssh remote
# command. Unlike `printf %q`, single-quoted output re-parses correctly
# under any POSIX shell (the origin login shell need not be bash) and is
# lossless for arbitrary bytes. Each embedded ' becomes the '\'' sequence.
sq() {
local s=${1//\'/\'\\\'\'}
printf "'%s'" "$s"
}
USR=`/usr/bin/whoami`
USER_TOKEN_PATH="/var/.cagefs/.cagefs.token"
WEBSITE_ISOLATION_FLAG="/opt/cloudlinux/flags/enabled-flags.d/website-isolation.flag"
# Trust boundary for the website-isolation token path: it must point
# directly at the regular file that create_website_token_directory()
# creates inside its root-owned per-user storage area. That area is
# /var/cagefs/<prefix>/<user>/.cagefs/website/... on the host and is
# bind-mounted into the cage at /var/.cagefs/website/... — both views
# are accepted because libenter.enter_site() picks one or the other
# depending on whether it runs inside or outside the cage. The file
# itself is never a symlink, so we reject symlinks outright rather
# than canonicalizing with realpath. Without this gate the attacker
# controls both the env var WEBSITE_TOKEN_PATH and the file contents
# at that path; the file contents land in $TOKEN, which is embedded
# into the ssh remote command argv below and re-parsed by the remote
# shell — so shell metacharacters in the file would execute on the
# origin host. (Slite #7 / CLOS-4490)
if [[ -f "$WEBSITE_ISOLATION_FLAG" && -n "$WEBSITE_TOKEN_PATH" ]]; then
if [[ -L "$WEBSITE_TOKEN_PATH" ]]; then
echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not be a symlink" >&2
exit 1
fi
if [[ ! -f "$WEBSITE_TOKEN_PATH" ]]; then
echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' is not an existing regular file" >&2
exit 1
fi
# Reject `..` as a path component so the prefix check below cannot
# be bypassed via traversal (e.g. /var/cagefs/../etc/passwd matches
# the /var/cagefs/* glob but resolves outside the trusted area).
case "$WEBSITE_TOKEN_PATH" in
*/../*|*/..)
echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not contain '..' path components" >&2
exit 1
;;
esac
case "$WEBSITE_TOKEN_PATH" in
/var/cagefs/*|/var/.cagefs/*) ;;
*)
echo "cagefs.proxy: WEBSITE_TOKEN_PATH must be under /var/cagefs/ or /var/.cagefs/ (got '$WEBSITE_TOKEN_PATH')" >&2
exit 1
;;
esac
USER_TOKEN_PATH="$WEBSITE_TOKEN_PATH"
fi
# The -L/-f/prefix gate above is defense-in-depth, TOCTOU is not exploitable because the
# forwarded $TOKEN must still equal the legit on-disk bytes that the
# origin's cagefs.server reads with open(..., O_NOFOLLOW) from a
# uid-derived path (see find_website_by_token() in
# proxyexec/cagefs.server.c) — a swapped symlink redirects what we
# cat, never what the server reads, so a TOCTOU substitution can only
# replace the forwarded bytes with something that fails the server's
# constant-time comparison.
TOKEN=`/bin/cat ${USER_TOKEN_PATH}`
# Tokens are generated as fixed-length alphanumerics by
# _generate_password() in py/clcagefslib/webisolation/jail_utils.py and
# by the corresponding C helper. Any non-alphanumeric byte means the
# token file was tampered with — refuse to forward it into the ssh
# remote command, where the remote shell would re-parse metacharacters.
# Use POSIX `case` rather than `[[ =~ ]]` because the wrapper is also
# invoked through `sh` (e.g. jenkins_tests/rpm_tests/p_cagefs/
# 939-environment_var-check.sh), and dash treats `[[` as a missing
# command — the regex form would falsely trip and exit the script.
case "$TOKEN" in
"" | *[!A-Za-z0-9]*)
echo "cagefs.proxy: refusing to forward malformed token from $USER_TOKEN_PATH" >&2
exit 1
;;
esac
# It's user's tmp directory and write to it is secure procedure
# because this script is running only under usual user
PIDFILE="/tmp/.cagefs.proxy.$$"
USER_INTERRUPT=13
CWD=`pwd`
ctrl_c_handler() {
if [[ -f "$PIDFILE" ]]; then
pid=`/bin/cat $PIDFILE`
/bin/rm -f $PIDFILE > /dev/null 2>&1
/bin/kill -s SIGINT "$pid" > /dev/null 2>&1
fi
exit $USER_INTERRUPT
}
if [[ -e /var/.cagefs/origin ]]; then
ORIGIN=`/bin/cat /var/.cagefs/origin`
# ssh(1) joins the remote-command argv with single spaces and ships
# the result for the origin user's login shell to re-parse. The local
# bash double-quotes around "$CWD" and "$@" only protect parsing on
# THIS host — once ssh has taken the argv, the quoting is gone and
# any shell metacharacter embedded in $CWD (`pwd`, attacker controls
# via mkdir+cd inside the cage) or in any "$@" element (caller argv
# for sendmail/crontab/etc.) is interpreted by the remote shell.
# CLOS-4490 hardened $TOKEN by content validation; that approach
# does not work for $CWD or $@ (legitimate paths/args may contain
# spaces, parens, ampersands), so we single-quote each caller-
# controlled element with sq() before composing the remote command.
# ssh re-parses the command only once (the origin login shell), so a
# single quoting pass per value is enough here. $USR is `whoami` so
# it cannot contain metacharacters in any sane account database, but
# we quote it too for defense in depth. (CLOS-4596)
Q_ARGS=
for _arg in "$@"; do
Q_ARGS="$Q_ARGS $(sq "$_arg")"
done
/usr/bin/ssh -F /etc/ssh/cagefs-rexec_config "$USR@$ORIGIN" \
"CAGEFS_TOKEN=$TOKEN /usr/sbin/proxyexec -c cagefs.sock $(sq "$USR") $(sq "$CWD") CAGEFS_ENTER $$$Q_ARGS"
RETVAL=$?
else
trap 'ctrl_c_handler' 2
CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock "$USR" "$CWD" CAGEFS_ENTER $$ "$@"
RETVAL=$?
/bin/rm -f $PIDFILE > /dev/null 2>&1
fi
exit $RETVAL
Directory Contents
Dirs: 0 × Files: 493
!"#$%&'(()*+,-./00123456789 t\
wIDATx ]ys 47Y ƒ - " Rv < f{Ɛ $k l L > L ~h^ 1 [ r G t& h
l F z3O Y ! p A(_g̷ E8 )S 8 c Kb"z ~ 5 J xAL WU < *
5 m;W a pB h ~P J
2 3 6 ҙ .Ƹ P i 4g
F R L P ΪK/D M v (a3
k J
Œ4N5* SH ` SdJ z O J Xՠ V> u ߱ BE&L b2 ?2` tX+ c CB A$ i b C ĀMB E : / # Dx &l =q Ty 0 \p I ( L Ǎ { e
4k ;`u^ｦ eP!( d { )T A 8 O;Ě n >;s6 ! :Nx `[S D HU ~ qJ F}
a g*D 49 / pn k h (t 8NxƐF _!r չ7
ZR R q/5") Ӎ NY 0 x sZ! o
fu , K"$ ? pg 㕣= 1» {h " fh7
y } +7 $ y
" X ą - G P u 4 m >J 5 L =V ' ^@I p ?MS xЌ XV P ! h "C NS9B8̢ ]!K e zA , ӏkbY !< XQ ٿyS| *" f { w 4@[S <
# 0 ! js [m =,~ o
"ݎ DHf Wo $ g ! Vԅ t mB /y Wf V4 c+@x? B ~u " xUN e 0 BĂ)
~J pz!
7 y6]l Ԥ@ P a< O /DHC `≻ N m"$ 0ObB }{ x AO FCG D R ^ "B { WDH UR l@ T
# +"d T ; 0 i D}. 7 ` ' ] w rE &S i ƕiTD EL P _ u h $ Ա FG wVD G L R Zf ' .!] J /ZR oGЍ s Mr Ĥ ʬ 3 Q [3 cL ` ^ p +
( F;# B 5 ' 2Y f [ ϶R0e } E 7
6M aۮ H <& n % L] E}Up x紉, Uw' Q Ǯշo k ވۙ 0N94 VX5 xEDE l D #֤ } C o )W : ^ s 9 bRf iX5u ཱི 4 :[ T 1. | [E 2ؽ Iy\ : o x K G 5
ylP ' uK E
ftb/i[3 .g _ [3M n
G, #NwQ5~
ؚ) | n =Ц"x qg gB ` 듘 ~ x w ?
?
R~ _ u. &V Q K˻ H C ( TN˄+ `C dA n B D 3"Z G ê ^k H_ /- ~ " R_ .8 Z_ 6@ o xg uP ? 3լ @7AM! E7^
- =V L x g-D0 CtmW 7 O G _ WD0 g C w1 r
d w : a | \ *" f nֳ ^ H# f L ` Z ۽hV }S F r0Ù Bć5r] @! NL iQ]{s^=4 d WD " " M;
t" 8 5 e dL| "-*st" ) SWD ?R[S e ooF 20.D ? bo =) A i o d ģ ZҰaO
@E =) i D a &ܟa CϞ y6 ,<%{^x%{f8? `iw^ ?/
M
* IEND B`