This file is indexed.

/usr/share/pyshared/rdiff_backup/Security.py is in rdiff-backup 1.2.8-7.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
# Copyright 2002 Ben Escoto
#
# This file is part of rdiff-backup.
#
# rdiff-backup is free software; you can redistribute it and/or modify
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.
#
# rdiff-backup is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with rdiff-backup; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
# USA

"""Functions to make sure remote requests are kosher"""

import sys, tempfile, types
import Globals, Main, rpath, log

class Violation(Exception):
	"""Exception that indicates an improper request has been received"""
	pass


# This will store the list of functions that will be honored from
# remote connections.
allowed_requests = None

# This stores the list of global variables that the client can not
# set on the server.
disallowed_server_globals = ["server", "security_level", "restrict_path"]

# Some common file commands we may want to check to make sure they are
# in the right directory.  Any commands accessing files that could be
# added to allowed_requests must be here.
#
# The keys are files request, the value is the index of the argument
# taking a file.
file_requests = {'os.listdir':0, 'rpath.make_file_dict':0, 'os.chmod':0,
				 'os.chown':0, 'os.remove':0, 'os.removedirs':0,
				 'os.rename':0, 'os.renames':0, 'os.rmdir':0, 'os.unlink':0,
				 'os.utime':0, 'os.lchown':0, 'os.link':1, 'os.symlink':1,
				 'os.mkdir':0, 'os.makedirs':0,
				 'rpath.delete_dir_no_files':0}
				 
def initialize(action, cmdpairs):
	"""Initialize allowable request list and chroot"""
	global allowed_requests
	set_security_level(action, cmdpairs)
	set_allowed_requests(Globals.security_level)

def reset_restrict_path(rp):
	"""Reset restrict path to be within rpath"""
	assert rp.conn is Globals.local_connection
	Globals.restrict_path = rp.normalize().path

def set_security_level(action, cmdpairs):
	"""If running client, set security level and restrict_path

	To find these settings, we must look at the action to see what is
	supposed to happen, and then look at the cmdpairs to see what end
	the client is on.

	"""
	def islocal(cmdpair): return not cmdpair[0]
	def bothlocal(cp1, cp2): return islocal(cp1) and islocal(cp2)
	def bothremote(cp1, cp2): return not islocal(cp1) and not islocal(cp2)
	def getpath(cmdpair): return cmdpair[1]

	if Globals.server: return
	cp1 = cmdpairs[0]
	if len(cmdpairs) > 1: cp2 = cmdpairs[1]
	else: cp2 = cp1

	if action == "backup" or action == "check-destination-dir":
		if bothlocal(cp1, cp2) or bothremote(cp1, cp2):
			sec_level = "minimal"
			rdir = tempfile.gettempdir()
		elif islocal(cp1):
			sec_level = "read-only"
			rdir = getpath(cp1)
		else:
			assert islocal(cp2)
			sec_level = "update-only"
			rdir = getpath(cp2)
	elif action == "restore" or action == "restore-as-of":
		if len(cmdpairs) == 1 or bothlocal(cp1, cp2) or bothremote(cp1, cp2):
			sec_level = "minimal"
			rdir = tempfile.gettempdir()
		elif islocal(cp1):
			sec_level = "read-only"
			Main.restore_set_root(rpath.RPath(Globals.local_connection,
											  getpath(cp1)))
			if Main.restore_root: rdir = Main.restore_root.path
			else: log.Log.FatalError("Invalid restore directory")
		else:
			assert islocal(cp2)
			sec_level = "all"
			rdir = getpath(cp2)
	elif action == "mirror":
		if bothlocal(cp1, cp2) or bothremote(cp1, cp2):
			sec_level = "minimal"
			rdir = tempfile.gettempdir()
		elif islocal(cp1):
			sec_level = "read-only"
			rdir = getpath(cp1)
		else:
			assert islocal(cp2)
			sec_level = "all"
			rdir = getpath(cp2)
	elif action in ["test-server", "list-increments", 'list-increment-sizes',
					"list-at-time", "list-changed-since",
					"calculate-average", "remove-older-than", "compare",
					"compare-hash", "compare-full", "verify"]:
		sec_level = "minimal"
		rdir = tempfile.gettempdir()
	else: assert 0, "Unknown action %s" % action

	Globals.security_level = sec_level
	Globals.restrict_path = rpath.RPath(Globals.local_connection,
										rdir).normalize().path

def set_allowed_requests(sec_level):
	"""Set the allowed requests list using the security level"""
	global allowed_requests
	l = ["VirtualFile.readfromid", "VirtualFile.closebyid",
		 "Globals.get", "Globals.is_not_None", "Globals.get_dict_val",
		 "log.Log.open_logfile_allconn", "log.Log.close_logfile_allconn",
		 "Log.log_to_file", "FilenameMapping.set_init_quote_vals_local",
		 "FilenameMapping.set_init_quote_vals",
		 "SetConnections.add_redirected_conn", "RedirectedRun",
		 "sys.stdout.write", "robust.install_signal_handlers"]
	if (sec_level == "read-only" or sec_level == "update-only" or
		sec_level == "all"):
		l.extend(["rpath.make_file_dict", "os.listdir", "rpath.ea_get",
				  "rpath.acl_get", "rpath.setdata_local",
				  "log.Log.log_to_file", "os.getuid", "Time.setcurtime_local",
				  "rpath.gzip_open_local_read", "rpath.open_local_read",
				  "Hardlink.initialize_dictionaries", "user_group.uid2uname",
				  "user_group.gid2gname"])
	if sec_level == "read-only" or sec_level == "all":
		l.extend(["fs_abilities.get_readonly_fsa",
				  "restore.MirrorStruct.get_increment_times",
				  "restore.MirrorStruct.set_mirror_and_rest_times",
				  "restore.MirrorStruct.set_mirror_select",
				  "restore.MirrorStruct.initialize_rf_cache",
				  "restore.MirrorStruct.close_rf_cache",
				  "restore.MirrorStruct.get_diffs",
				  "restore.ListChangedSince",
				  "restore.ListAtTime",
				  "backup.SourceStruct.get_source_select",
				  "backup.SourceStruct.set_source_select",
				  "backup.SourceStruct.get_diffs",
				  "compare.RepoSide.init_and_get_iter",
				  "compare.RepoSide.close_rf_cache",
				  "compare.RepoSide.attach_files",
				  "compare.DataSide.get_source_select",
				  "compare.DataSide.compare_fast",
				  "compare.DataSide.compare_hash",
				  "compare.DataSide.compare_full",
				  "compare.Verify"])
	if sec_level == "update-only" or sec_level == "all":
		l.extend(["log.Log.open_logfile_local", "log.Log.close_logfile_local",
				  "log.ErrorLog.open", "log.ErrorLog.isopen",
				  "log.ErrorLog.close",
				  "backup.DestinationStruct.set_rorp_cache",
				  "backup.DestinationStruct.get_sigs",				 
				  "backup.DestinationStruct.patch_and_increment",
				  "Main.backup_touch_curmirror_local",
				  "Main.backup_remove_curmirror_local",
				  "regress.check_pids",
				  "Globals.ITRB.increment_stat",
				  "statistics.record_error",
				  "log.ErrorLog.write_if_open",
				  "fs_abilities.backup_set_globals"])
	if sec_level == "all":
		l.extend(["os.mkdir", "os.chown", "os.lchown", "os.rename",
				  "os.unlink", "os.remove", "os.chmod", "os.makedirs",
				  "rpath.delete_dir_no_files",
				  "backup.DestinationStruct.patch",
				  "restore.TargetStruct.get_initial_iter",
				  "restore.TargetStruct.patch",
				  "restore.TargetStruct.set_target_select",
				  "fs_abilities.restore_set_globals",
				  "fs_abilities.single_set_globals",
				  "regress.Regress", "manage.delete_earlier_than_local"])
	if Globals.server:
		l.extend(["SetConnections.init_connection_remote",
				  "log.Log.setverbosity", "log.Log.setterm_verbosity",
				  "Time.setprevtime_local", "Globals.postset_regexp_local",
				  "Globals.set_select", "backup.SourceStruct.set_session_info",
				  "backup.DestinationStruct.set_session_info",
				  "user_group.init_user_mapping",
				  "user_group.init_group_mapping"])
	allowed_requests = {}
	for req in l: allowed_requests[req] = None

def raise_violation(request, arglist):
	"""Raise a security violation about given request"""
	raise Violation("\nWarning Security Violation!\n"
					"Bad request for function: %s\n"
					"with arguments: %s\n" % (request.function_string,
											  arglist))

def vet_request(request, arglist):
	"""Examine request for security violations"""
	#if Globals.server: sys.stderr.write(str(request) + "\n")
	security_level = Globals.security_level
	if security_level == "override": return
	if Globals.restrict_path:
		for arg in arglist:
			if isinstance(arg, rpath.RPath): vet_rpath(arg)
		if request.function_string in file_requests:
			vet_filename(request, arglist)
	if request.function_string in allowed_requests: return
	if request.function_string in ("Globals.set", "Globals.set_local"):
		if arglist[0] not in disallowed_server_globals: return
	raise_violation(request, arglist)

def vet_rpath(rpath):
	"""Require rpath not to step outside retricted directory"""
	if Globals.restrict_path and rpath.conn is Globals.local_connection:
		normalized, restrict = rpath.normalize().path, Globals.restrict_path
		if restrict == "/": return
		components = normalized.split("/")
		# 3 cases for restricted dir /usr/foo:  /var, /usr/foobar, /usr/foo/..
		if (not normalized.startswith(restrict) or
			(len(normalized) > len(restrict) and
			 normalized[len(restrict)] != "/") or
			".." in components):
			raise Violation("\nWarning Security Violation!\n"
							"Request to handle path %s\n"
							"which doesn't appear to be within "
							"restrict path %s.\n" % (normalized, restrict))

def vet_filename(request, arglist):
	"""Check to see if file operation is within the restrict_path"""
	i = file_requests[request.function_string]
	if len(arglist) <= i: raise_violation(request, arglist)
	filename = arglist[i]
	if type(filename) is not types.StringType:
		raise_violation(request, arglist)
	vet_rpath(rpath.RPath(Globals.local_connection, filename))