File: chkutmp.patch

package info (click to toggle)
chkrootkit 0.58b-5
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 7,796 kB
  • sloc: sh: 187,095; ansic: 3,779; makefile: 103
file content (161 lines) | stat: -rw-r--r-- 5,300 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
From: Richard Lewis <richard.lewis.debian@googlemail.com>
Date: Sat, 16 Oct 2021 23:51:50 +0100
Subject: chkutmp

Last-Updated: 2024-11-06

Various, minor, patches to improve chkutmp.

0) Improve output -- the message needs 'was' not 'were' because "The tty" is singular
 Author: Richard Lewis <richard.lewis.debian@googlemail.com>
 Date: Sat, 16 Oct 2021 23:51:50 +0100

1a) Improve parser
 - Use larger arrays for ps_tty, ps_user, ps_args to avoid overflow
 - Use 'ps axk' (not really necessary)
 - replace newlines with \0 on parsing
  From: "Aaron M. Ucko" <team+pkg-security@tracker.debian.org>
  Date: Sun, 9 Jul 2017 18:42:55 +0200

1b) From an unknown author, in Debian since 2017 or earlier
 - when grabbing pid, limit size to UT_PIDSIZE not UT_LINESIZE
    (avoid possible overflow in pid)

2) avoid various compilation warnings
  These were contributed by =?utf-8?q?Christian_G=C3=B6ttsche?= <cgzones@googlemail.com>
  on Date: Fri, 24 Jul 2020 16:28:53 +0200
  a) declare cmd as 'const'
  b) make signature of main be void, since argc and argv are unused
  c) remove unused variable

3) Improve output -- the message needs 'was' not 'were' because "The tty" is singular
 Author: Richard Lewis <richard.lewis.debian@googlemail.com>
 Date: Sat, 16 Oct 2021 23:51:50 +0100

4) chkutmp: do not silently do nothing on unsupported platforms
  Author: Richard Lewis <richard.lewis.debian@googlemail.com>, Nov 2024

Forwarded: yes
 (Forwarded by email: 21 Dec 2024)
---
 chkutmp.c | 51 +++++++++++++++++++++++++--------------------------
 1 file changed, 25 insertions(+), 26 deletions(-)

diff --git a/chkutmp.c b/chkutmp.c
index 5c81a72..4deff10 100644
--- a/chkutmp.c
+++ b/chkutmp.c
@@ -28,12 +28,12 @@
  *
  */
 
+#include <stdio.h>
 #if !defined(__sun) && !defined(__linux__)
-int main () { return 0; }
+int main (void){ fprintf(stderr,"Unsupported operating system\n"); return 1; }
 #else
 #include <unistd.h>
 #include <stdlib.h>
-#include <stdio.h>
 #include <string.h>
 #include <utmp.h>
 #include <fcntl.h>
@@ -59,9 +59,9 @@ int main () { return 0; }
 #endif
 
 struct ps_line {
-    char ps_tty[UT_LINESIZE];
-    char ps_user[UT_NAMESIZE];
-    char ps_args[MAXLENGTH];
+    char ps_tty[UT_LINESIZE+2];
+    char ps_user[UT_NAMESIZE+2];
+    char ps_args[MAXLENGTH+2];
     int ps_pid;
 };
 struct utmp_line {
@@ -69,9 +69,9 @@ struct utmp_line {
     int ut_pid;
     int ut_type;
 };
-static char *cmd[] = {
+static const char *cmd[] = {
     "ps -ef -o \"tty,pid,ruser,args\"",	/* solaris */
-    "ps ax -o \"tty,pid,ruser,args\""	/* linux */
+    "ps axk \"tty,ruser,args\" -o \"tty,pid,ruser,args\""	/* linux */
 };
 int fetchps(struct ps_line *);
 int fetchutmp(struct utmp_line *);
@@ -87,7 +87,7 @@ int fetchps(struct ps_line *psl_p)
 
     i = 0;
     if ((ps_fp = (popen(cmd[PS_CMD], "r"))) != NULL) {
-	fgets(line, MAXREAD, ps_fp);	/* skip header */
+	(void) !fgets(line, MAXREAD, ps_fp);	/* skip header */
 	while (fgets(line, MAXREAD, ps_fp)) {
 	    s = line;
 	    if (*s != '\?' && curp <= endp) {	/* only interested in lines that
@@ -99,7 +99,7 @@ int fetchps(struct ps_line *psl_p)
 		while (isspace(*s))	/* skip spaces */
 		    s++;
 		d = pid;
-		for (x = 0; (!isspace(*s)) && (*d++ = *s++) && x <= UT_LINESIZE; x++)	/* grab pid */
+		for (x = 0; (!isspace(*s)) && (*d++ = *s++) && x <= UT_PIDSIZE; x++)	/* grab pid */
 		    ;
 		*d = '\0';
 		curp->ps_pid = atoi(pid);
@@ -114,14 +114,16 @@ int fetchps(struct ps_line *psl_p)
 		    s++;
 		for (x = 0; (*d++ = *s++) && x <= MAXLENGTH; x++)	/* cmd + args */
 		    ;
+		if (d[-2] == '\n')
+			d[-2] = '\0';
 		i++;
 		curp++;
-                /* if we didn't read the line, skip the rest */ 
-                line_length = strlen(line); 
-                while (!(line_length == 0 || line[line_length -1] == '\n')) { 
-                   fgets(line, MAXREAD, ps_fp);
-                   line_length = strlen(line); 
-                } 
+                /* if we didn't read the line, skip the rest */
+                line_length = strlen(line);
+                while (!(line_length == 0 || line[line_length -1] == '\n')) {
+                   (void) !fgets(line, MAXREAD, ps_fp);
+                   line_length = strlen(line);
+                }
 	    }
 	}
 	pclose(ps_fp);
@@ -175,7 +177,7 @@ int fetchutmp(struct utmp_line *utl_p)
     return i;
 }
 
-int main(int argc, char *argv[])
+int main(void)
 {
     struct ps_line ps_l[MAXBUF];	/* array of data from 'ps' */
     struct utmp_line ut_l[MAXBUF];	/* array of data from utmp log */
@@ -201,16 +203,13 @@ int main(int argc, char *argv[])
 	    }
 	}
 	if (!mtch_fnd) {
-	    if (!hdr_prntd) {
-		printf
-		    (" The tty of the following user process(es) were not found\n");
-		printf(" in %s !\n", UTMP);
-		printf("! %-9s %7s %-6s %s\n", "RUID", "PID", "TTY",
-		       "CMD");
-		hdr_prntd = 1;
-	    }
-	    printf("! %-9s %7d %-6s %s", ps_l[h].ps_user,
-		   ps_l[h].ps_pid, ps_l[h].ps_tty, ps_l[h].ps_args);
+		if (!hdr_prntd) {
+			printf("The tty of the following process(es) was not found in %s:\n", UTMP);
+			printf("! %-9s %7s %-6s %s\n", "RUID", "PID", "TTY", "CMD");
+			hdr_prntd = 1;
+		}
+		printf("! %-9s %7d %-6s %s\n", ps_l[h].ps_user,
+					 ps_l[h].ps_pid, ps_l[h].ps_tty, ps_l[h].ps_args);
 	}
     }
     exit(EXIT_SUCCESS);