[BusyBox] BusyBox suid-wrappers, part 111

[Tomi Ollila]

Hi

Yet some more ideas to handle this suid execution problem:

Imagine all the following examples being in a file that is hard and/or
symlinked at least to filenames `mount´, `ping´, `su´, `umount´ and this
file is suid-root.

1) Lame version, does not regognize between /tmp/rm and /bin/ping

-8<--8<--8<--8<--8<--8<--8<--8<-
#!/bin/sh

exec $*
exit 1
-8<--8<--8<--8<--8<--8<--8<--8<-

2) Version that checks that the binary is located at /bin/ (or some of it´s
   subdirectories... hmm...). Does lame know syntax of case -statements?

-8<--8<--8<--8<--8<--8<--8<--8<-
#!/bin/ash

case $1 in
	/bin/*) exec $*;;
esac
exit 1
-8<--8<--8<--8<--8<--8<--8<--8<-

3) Version that checks the binary is one of the named ones:

-8<--8<--8<--8<--8<--8<--8<--8<-
#!/bin/ash

case $1 in
	*/mount) exec $*;;
	*/ping) exec $*;;
	*/su) exec $*;;
	*/umount) exec $*;;
esac
exit 1
-8<--8<--8<--8<--8<--8<--8<--8<-

4) A separate busybox program (which needs to be written) to check whether
   the program can be suid-run. The program parses the contents of this
   file after the `exit´ -line to find allowed program names. Now we can
   again use bb lame ass shell.

-8<--8<--8<--8<--8<--8<--8<--8<-
#!/bin/sh

exec /bin/busybox suid-launcher $*
exit 1

mount umount
ping
su
-8<--8<--8<--8<--8<--8<--8<--8<-

In case 4, 3 program launches is required to get the suid binary
running. This thing can be reduced to 2 (with simpler suid-wrapper)...

5) Launch suid-launcher directly from #! -syntax:

-8<--8<--8<--8<--8<--8<--8<--8<-
#!/bin/bbsl

mount umount
ping
su
-8<--8<--8<--8<--8<--8<--8<--8<-

bbsl would be new busybox applet; it only needs first to parse through
first newline of the file, and then compare each whitespace separated
string with the command name and if match is found, 
run /bin/busybox <command> <args...>. And more suid binaries are easy
to add, make them sym/hardlinked to this "script" and add the binary
name to the same script.

What do you think. If this idea gets more support, I´m willing to implement
the applet. I already have quite clear idea how to do small, rock-solid
implementation of it...

Tomi