File: chkdirs.c

package info (click to toggle)
chkrootkit 0.58b-6
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 7,796 kB
  • sloc: sh: 187,089; ansic: 3,779; makefile: 103
file content (246 lines) | stat: -rw-r--r-- 7,047 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
/* Copyright (C) Hal Pomeranz <hal@deer-run.com> and Deer Run Assoc, 2002/11/24
   All rights reserved.  Permission granted to freely redistribute and update
   as long as this Copyright notice is preserved.  No warranty expressed or
   implied.

   $Id: chkdirs.c,v 1.3 2003/01/20 19:44:13 hal Exp $


   Usage:     chkdirs [-n] dir ...
   Examples:  chkdirs /
              chkdirs -n /proc
   Recursively traverses one or more directories looking for discrepancies
   between the parent directory link count and the number of subdirectories
   (parent directory link count should always equal the number of subdirs
   plus two-- anything else indicates a "hidden" directory).  "-n" option
   means check directory but don't recursively descend into subdirectories.

  Changelog :
  2002/12/19 - Little port for *BSB and Solaris - Nelson Murilo
  2003/01/09 - More fix for Solaris - Nelson Murilo
  2003/01/14 - HP-UX patch - Gerard Breiner
  2003/01/20 - NAME_MAX Fix by Hal Pomeranz
  2003/09/01 - BSDI port by Nelson Murilo and Thomas Davidson
  2005/22/05 - APPLE test for limits.h included by Aaron Harwood
  2007/08/10 - strncpy used instead of strcpy - nm
  2007/12/24 - change `c' variable type - NIDE, Naoyuki
  2020/12/24 - Add a warning for btrfs (no inode usage)

*/

#if defined(__APPLE__) || defined(__MACH__)
#include <sys/syslimits.h>
#else
#include <limits.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dirent.h>
#include <string.h>
#include <errno.h>

#ifndef NAME_MAX
#ifndef PATH_MAX
#define PATH_MAX 4096
#endif
#define NAME_MAX PATH_MAX
#endif

#ifdef __linux__
#include "sys/statfs.h"
#include "linux/magic.h"
const char* file_system_name(__fsword_t f_type) {
  // we only need to list problematic types here
  switch (f_type) {
  case OVERLAYFS_SUPER_MAGIC:
    return "overlayfs";
  case BTRFS_TEST_MAGIC:
    return "btrfs";
  default:
    return "unsupported type";
  }
}
#else
typedef long __fsword_t;
struct statfs { __fsword_t f_type; };
const char* file_system_name(__fsword_t f_type) {
  return "unsupported";
}
long statfs(const char *path, struct statfs *buf){
  return 1;
}
#endif

#ifdef __GNUC__
__attribute__((__noreturn__))
#endif
void usage (void)
{
  fprintf(stderr, "chkdirs [-n] dir ...\n");
  exit(255);
}


// append dir to path (and add a \0). path should start if a string of
// length pathlen (excluding any \0). we return the new length
// (excluding the terminating \0 which we add). This means path must
// be able to grow to NAME_MAX including the dir, a trailing / and a
// new \0 -- If new length will not fit we exit(2). dir should not end
// in a / -- one will be added.
int append_to_path(char* path, int pathlen, const char* dir){
  int dirlen=strlen(dir);
  int newpathlen=pathlen+dirlen+1; // old+new+/

  if (newpathlen > NAME_MAX-1) {
    fprintf(stderr, "chkdirs: ERROR: path too long: %s/%s\n", path, dir);
    exit(2);
  }

  path[pathlen]='/'; // replace \0
  memcpy(path+pathlen,dir,dirlen); // apppend dir, overwriting \0
  path[newpathlen-1]='/'; // append /
  path[newpathlen]='\0';  // nb: newpathlen <= NAME_MAX-1

  return newpathlen;
}

/* Check path for hidden files.
   - path = pointer to buffer holding path of a dir
      to check. This will be modified if we recurse
   - pathlen = strlen(path)
   - linkcount = number of links in path (as seen by
     parent).  If 0: stat path to set this)
   - norecurse = 0 or 1 - should we recurse (1=no) into subdirs

  returns: 0 (all ok) / 1 (hidden files) / 2 (error)
  on errors, subsequent calls may fail if path is relative
 */

int check_dir (char *path, int pathlen, int linkcount, int norecurse)
{
  int diff = -1, retval = 0, numdirs = 0;

  DIR *dirhandle;
  struct dirent *finfo;
  struct stat statinfo;

  int newpathlen; // length of 'path/subdir'

  if (chdir(path)) {
    fprintf(stderr, "chkdirs: WARNING: chdir(%s): %s\n", path, strerror(errno));
    return(2);
  }

  /* "linkcount" (the link count of the current directory) is non-zero
     only if check_dir() was called recursively.  Otherwise, we need to
     stat the directory ourselves.
  */
  if (!linkcount) {
    if (lstat(".", &statinfo)) {
      fprintf(stderr, "chkdirs: WARNING: cannot read linkcount: lstat(%s): %s\n", path, strerror(errno));
      return(2);
    }
    linkcount = statinfo.st_nlink;
    if (linkcount == 1)
    {
	  struct statfs fstatinfo;
	  if (statfs(".",&fstatinfo))
		fprintf(stderr, "chkdirs: WARNING: Skipping unsupported filesystem (could not check type): %s\n", path);
	  else
		fprintf(stderr, "chkdirs: WARNING: Skipping unsupported filesystem (%s): %s\n", file_system_name(fstatinfo.f_type), path);
      return(2);
     }
  }

  if (!(dirhandle = opendir("."))) {
    fprintf(stderr, "chkdirs: WARNING: opendir(%s): %s\n", path, strerror(errno));
    return(2);
  }

  while ((finfo = readdir(dirhandle))) {
    if (!strcmp(finfo->d_name, ".") || !strcmp(finfo->d_name, ".."))
      continue;

    if (lstat(finfo->d_name, &statinfo)) {
      fprintf(stderr, "chkdirs: WARNING: cannot lstat(%s/%s): %s\n",
              path, finfo->d_name, strerror(errno));
      closedir(dirhandle);
      retval = 2;
      continue;
    }

    if (S_ISDIR(statinfo.st_mode)) {
      ++numdirs;

      if (norecurse)
        continue; /* just count subdirs if "-n" */

      if (statinfo.st_nlink > 2) { // why trust st.nlink here ?????
        newpathlen = append_to_path(path, pathlen, finfo->d_name);
        diff = check_dir(path, newpathlen, statinfo.st_nlink, norecurse);
        if (diff > retval) retval = diff;
        path[pathlen] = '\0'; // reset path

        if (chdir(path)) { // reset cwd
          fprintf(stderr, "chkdirs: WARNING: Final chdir(%s) failed (%s) -- EXIT!\n", path, strerror(errno));
          return(2);
        }
      }
    }
  }
  closedir(dirhandle);

  /* Parent directory link count had better equal #subdirs+2... */
  diff = linkcount - numdirs - 2;
  if (diff) {
    if (retval < 2) retval = 1;
    printf("Possible hidden file(s) in %s: expected %d link(s) but found %d\n", path, numdirs, linkcount - 2);
  }
  return(retval);
}


int main (int argc, char **argv)
{
  int norecurse = 0;
  int i, retval = 0;
  int c;
  char path[NAME_MAX]="";
  int pathlen=0;

  opterr = 0;
  while ((c = getopt(argc, argv, "n")) > 0) {
    switch (c) {
    case 'n':
      norecurse = 1;
      break;
    default:
      usage();
    }
  }
  if (argc <= optind) usage();

  for (i = optind; i < argc; ++i) {
    if (argv[i][0]!='/'){
      // relative dir: prepend cwd
      if (getcwd(path, NAME_MAX)==NULL) {
		fprintf(stderr, "chkdirs: WARNING: getwd(%s): %s\n", argv[i], strerror(errno));
		retval = 2;
		continue;
	  }
      pathlen = append_to_path(path, strlen(path), ""); // add trailing /
    } else {
      pathlen = 0;
      path[0] = '\0';
    }
    pathlen = append_to_path(path, pathlen, argv[i]);
    c = check_dir(path, pathlen, 0, norecurse);
    if (c > retval)
      retval = c;
  }
  exit(retval);
}