/* SUID wrapper script
Written by oleg.tsygany@omodo.com

Script basis was provided by DirectAdmin:
http://help.directadmin.com/item.php?id=510

************************************/

#define EACCES 13  // Permission denied
#define BUFF_LEN 128
#define PLUGIN_USER "cwaf_plugin"
#define CMD_NUM 6

#include <pwd.h>
#include <unistd.h>
#include <string.h>

char cmd[] = "/bin/perl";
char wrp[] = "/usr/local/cwaf/scripts/cwaf-wrapper.pl";

int main(int argc, char **argv) {
    int i;
    int c=0;

    char *cmd_argv[] = { 0, 0, 0, 0, 0, 0, 0 };

// Not enough params
    if (argc < 2) {
        return 0;
    }

    if (strcmp(argv[1], wrp) != 0) {
        // only wrapper run is allowed
        return EACCES;
    }

// various security checks
    uid_t original_uid = getuid();
    struct passwd *pwd_caller = getpwuid(original_uid);

// getpwuid error
    if (pwd_caller == NULL) {
        return EACCES; 
    }

// Couldn't get username from original_uid
    if (!pwd_caller->pw_name || strlen(pwd_caller->pw_name) > 16) {
        return EACCES;
    }
    char original_username[BUFF_LEN];
    strncpy(original_username, pwd_caller->pw_name, BUFF_LEN-1);

// Caller username appears to be blank
    if (*original_username == '\0') {
        return EACCES;
    }

// Not called by an right account
    if (strcmp(original_username, PLUGIN_USER)) {
        if (strcmp(original_username, "root")) {
            return EACCES;
        }
    }

// Error setting to uid 0. Wrapper rights have to be 4755.
    if (setuid(0) == -1) {
         return EACCES;
    }

// Error setting to gid 0. Wrapper rights have to be 4755.
    if (setgid(0) == -1) {
         return EACCES;
    }

// prepare command line
    cmd_argv[c++] = cmd;
    cmd_argv[c++] = wrp;
 
    for (i=2; i<argc && c<CMD_NUM; i++) {
        cmd_argv[c++] = argv[i];
    }

    char environ[120]="PATH=/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin";
    putenv(environ);

    execv(cmd, cmd_argv);

    return 0;
}