rsh.c File Reference

restricted shell to run bash as root More...

#include <cm.h>
#include <limits.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/resource.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <syslog.h>
#include <termios.h>
#include <unistd.h>

Include dependency graph for rsh.c:

Go to the source code of this file.

Macros
#define	_GNU_SOURCE
#define	HOST   "localhost"

Functions
void	ABEND (int e, char const *)
	Abnormal termination - print an error message and exit.
int	main (int argc, char **argv)
	Main function for rsh.

Variables
bool	F_VERBOSE = false

Detailed Description

restricted shell to run bash as root

Author

Bill Waller Copyright (c) 2025 MIT License billx.nosp@m.wall.nosp@m.er@gm.nosp@m.ail..nosp@m.com

Date

2026-02-09

Definition in file rsh.c.

Macro Definition Documentation

_GNU_SOURCE

#define _GNU_SOURCE

Definition at line 10 of file rsh.c.

HOST

#define HOST   "localhost"

Definition at line 29 of file rsh.c.

Function Documentation

ABEND()

void ABEND	(	int	e,
		char const *	s )

Abnormal termination - print an error message and exit.

Parameters

e	Error code
s	Error message

This function prints the provided error message along with the error code and its corresponding string representation, then exits the program with a failure status.

Definition at line 184 of file rsh.c.

                                 {
    fprintf(stderr, "%s: %d %s\n", s, e, strerror(e));
    exit(EXIT_FAILURE);
}

main()

int main	(	int	argc,
		char **	argv )

Main function for rsh.

Parameters

argc	Argument count
argv	Argument vector

If executed as 'rsh', this program sets the user ID and group ID to 0 (root) and then executes the user's default shell (or /usr/bin/bash if SHELL is not set) with the provided arguments. If no arguments are given, it runs the shell in interactive mode. To work properly, this program must be compiled and set with the setuid bit:

$ sudo -s
cc rsh.c -o rsh
sudo chown root:root rsh
sudo chmod 4755 rsh
exit

to verify proper operation:

$ rsh
$ whoami
root

Definition at line 77 of file rsh.c.

                                {
    char *cargv[30];
    char exec_cmd[MAXLEN] = "/usr/bin/bash";
    char *p;
    int c;
    bool ssh_login = false;
    int status;
    pid_t pid;
 
#ifdef RSH_PAM
    pam_handle_t *pamh = NULL;
    int retval;
    char *username = getenv("USER");
    if (username == NULL) {
        syslog(LOG_ERR, "USER environment variable not set");
        fprintf(stderr, "Error: USER environment variable not set\n");
        return 1;
    }
    retval = pam_start("rsh-auth", username, &conv, &pamh);
    if (retval != PAM_SUCCESS) {
        syslog(LOG_ERR, "PAM start failed: %s", pam_strerror(pamh, retval));
        fprintf(stderr, "PAM start failed: %s\n", pam_strerror(pamh, retval));
        return 1;
    }
 
    // Authenticate the user using PAM. The configuration for this PAM service should
    // be set to allow passwordless authentication, for example by using pam_permit.so.
    // You can create a PAM configuration file named /etc/pam.d/pam_nopass with the
    // following content:
    //
    // /etc/pam.d/pam_nopass:
    // auth required pam_permit.so
    //
    //
    retval = pam_authenticate(pamh, 0);
    if (retval == PAM_SUCCESS) {
        syslog(LOG_AUTH, "Authentication succeeded for user '%s': %s", username, pam_strerror(pamh, retval));
    } else {
        syslog(LOG_AUTH, "Authentication failed for user '%s': %s", username, pam_strerror(pamh, retval));
        fprintf(stderr, "Failure: Authentication failed: %s\n", pam_strerror(pamh, retval));
    }
 
    // It's a wrap
    pam_end(pamh, retval);
 
    if (retval != PAM_SUCCESS) {
        fprintf(stderr, "PAM authentication failed: %s\n", pam_strerror(pamh, retval));
        exit(EXIT_FAILURE);
    }
 
#endif
    if ((p = getenv("SHELL")))
        strncpy(exec_cmd, p, MAXLEN - 1);
    cargv[0] = strdup(exec_cmd);
    c = 1;
    if (argc > 0) {
        for (int i = 1; i < argc; i++) {
            if (strcmp(argv[i], "-i") == 0) {
                cargv[c++] = strdup("-i");
            } else if (strcmp(argv[i], "-D1") == 0 && ssh_login) {
                fprintf(stderr, "SSH authentication succeeded\n");
            } else {
                cargv[c++] = strdup(argv[i]);
            }
        }
    }
    cargv[c] = nullptr;
    pid = fork();
    switch (pid) {
    case -1:
        ABEND(EXIT_FAILURE, "fork() fatal error");
        break;
    case 0: // Child
        if (argv[0] && strstr(argv[0], "rsh")) {
            if (setuid(0) || setgid(0))
                ABEND(EXIT_FAILURE, "setuid(0) fatal error");
            struct rlimit rl;
            getrlimit(RLIMIT_FSIZE, &rl);
            rl.rlim_cur = RLIM_INFINITY;
            rl.rlim_max = RLIM_INFINITY;
            setrlimit(RLIMIT_FSIZE, &rl);
        }
        execvp(exec_cmd, cargv);
        ABEND(EXIT_FAILURE, "execvp() fatal error");
        break;
    default: // Parent
        waitpid(pid, &status, 0);
        for (int i = 0; i < c; i++)
            free(cargv[i]);
#ifdef F_VERBOSE
        if (WIFEXITED(status)) {
            rc = WEXITSTATUS(status);
            if (rc != 0)
                ABEND(rc, "Child process exited");
        } else {
            if (WIFSIGNALED(status)) {
                rc = WTERMSIG(status);
                ABEND(rc, "Child process terminated by signal");
            } else
                ABEND(EXIT_FAILURE, "Child process terminated abnormally");
        }
#endif
        break;
    }
    exit(EXIT_SUCCESS);
}

References ABEND().

Here is the call graph for this function:

Variable Documentation

F_VERBOSE

bool F_VERBOSE = false

Definition at line 37 of file rsh.c.