Copy original rev 1.2 - path updates for 4.4BSD so smrsh is more useable.
This commit is contained in:
parent
829be59c37
commit
1bceb5b259
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=38081
@ -37,7 +37,7 @@ limits the set of programs that he or she can execute.
|
||||
Briefly,
|
||||
.I smrsh
|
||||
limits programs to be in the directory
|
||||
/usr/adm/sm.bin,
|
||||
/usr/libexec/sm.bin,
|
||||
allowing the system administrator to choose the set of acceptable commands.
|
||||
It also rejects any commands with the characters
|
||||
`\`', `<', `>', `|', `;', `&', `$', `(', `)', `\er' (carriage return),
|
||||
@ -45,16 +45,15 @@ or `\en' (newline)
|
||||
on the command line to prevent ``end run'' attacks.
|
||||
.PP
|
||||
Initial pathnames on programs are stripped,
|
||||
so forwarding to ``/usr/ucb/vacation'',
|
||||
``/usr/bin/vacation'',
|
||||
so forwarding to ``/usr/bin/vacation'',
|
||||
``/home/server/mydir/bin/vacation'',
|
||||
and
|
||||
``vacation''
|
||||
all actually forward to
|
||||
``/usr/adm/sm.bin/vacation''.
|
||||
``/usr/libexec/sm.bin/vacation''.
|
||||
.PP
|
||||
System administrators should be conservative about populating
|
||||
/usr/adm/sm.bin.
|
||||
/usr/libexec/sm.bin.
|
||||
Reasonable additions are
|
||||
.IR vacation (1),
|
||||
.IR procmail (1),
|
||||
@ -73,11 +72,11 @@ it simply disallows execution of arbitrary programs.
|
||||
Compilation should be trivial on most systems.
|
||||
You may need to use \-DPATH=\e"\fIpath\fP\e"
|
||||
to adjust the default search path
|
||||
(defaults to ``/bin:/usr/bin:/usr/ucb'')
|
||||
(defaults to ``/bin:/usr/bin'')
|
||||
and/or \-DCMDBIN=\e"\fIdir\fP\e"
|
||||
to change the default program directory
|
||||
(defaults to ``/usr/adm/sm.bin'').
|
||||
(defaults to ``/usr/libexec/sm.bin'').
|
||||
.SH FILES
|
||||
/usr/adm/sm.bin \- directory for restricted programs
|
||||
/usr/libexec/sm.bin \- directory for restricted programs
|
||||
.SH SEE ALSO
|
||||
sendmail(8)
|
||||
|
@ -29,15 +29,15 @@ static char sccsid[] = "@(#)smrsh.c 8.11 (Berkeley) 5/19/98";
|
||||
**
|
||||
** Leading pathnames are stripped from program names so that
|
||||
** existing .forward files that reference things like
|
||||
** "/usr/ucb/vacation" will continue to work.
|
||||
** "/usr/bin/vacation" will continue to work.
|
||||
**
|
||||
** The following characters are completely illegal:
|
||||
** < > | ^ ; & $ ` ( ) \n \r
|
||||
** This is more restrictive than strictly necessary.
|
||||
**
|
||||
** To use this, edit /etc/sendmail.cf, search for ^Mprog, and
|
||||
** change P=/bin/sh to P=/usr/local/etc/smrsh, where this compiled
|
||||
** binary is installed /usr/local/etc/smrsh.
|
||||
** change P=/bin/sh to P=/usr/libexec/smrsh, where this compiled
|
||||
** binary is installed /usr/libexec/smrsh.
|
||||
**
|
||||
** This can be used on any version of sendmail.
|
||||
**
|
||||
@ -58,7 +58,7 @@ static char sccsid[] = "@(#)smrsh.c 8.11 (Berkeley) 5/19/98";
|
||||
|
||||
/* directory in which all commands must reside */
|
||||
#ifndef CMDDIR
|
||||
# define CMDDIR "/usr/adm/sm.bin"
|
||||
# define CMDDIR "/usr/libexec/sm.bin"
|
||||
#endif
|
||||
|
||||
/* characters disallowed in the shell "-c" argument */
|
||||
@ -66,7 +66,7 @@ static char sccsid[] = "@(#)smrsh.c 8.11 (Berkeley) 5/19/98";
|
||||
|
||||
/* default search path */
|
||||
#ifndef PATH
|
||||
# define PATH "/bin:/usr/bin:/usr/ucb"
|
||||
# define PATH "/bin:/usr/bin"
|
||||
#endif
|
||||
|
||||
int
|
||||
|
Loading…
Reference in New Issue
Block a user