Restrict shell access from vtysh to those that intentionally turn it on via a ./configure option. A suid vtysh without this change could potentially allow an attacker to elevate his priviledges.
Signed-off-by: Donald Sharp <[email protected]> --- configure.ac | 6 ++++++ vtysh/vtysh.c | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 8a88047..b2e174d 100755 --- a/configure.ac +++ b/configure.ac @@ -274,6 +274,8 @@ AC_ARG_ENABLE(configfile_mask, AS_HELP_STRING([--enable-configfile-mask=ARG], [set mask for config files])) AC_ARG_ENABLE(logfile_mask, AS_HELP_STRING([--enable-logfile-mask=ARG], [set mask for log files])) +AC_ARG_ENABLE(shell_access, + AS_HELP_STRING([--enable-shell-access], [Allow user to use ssh/telnet/bash])) AC_ARG_ENABLE(rtadv, AS_HELP_STRING([--disable-rtadv], [disable IPV6 router advertisement feature])) @@ -316,6 +318,10 @@ if test x"${enable_time_check}" != x"no" ; then fi fi +if test "${enable_shell_access}" = "yes"; then + AC_DEFINE(HAVE_SHELL_ACCESS,,Allow user to use ssh/telnet/bash) +fi + if test "${enable_fpm}" = "yes"; then AC_DEFINE(HAVE_FPM,,Forwarding Plane Manager support) fi diff --git a/vtysh/vtysh.c b/vtysh/vtysh.c index 04ac550..757176a 100644 --- a/vtysh/vtysh.c +++ b/vtysh/vtysh.c @@ -2051,6 +2051,7 @@ DEFUN (vtysh_traceroute6, } #endif +#if defined(HAVE_SHELL_ACCESS) DEFUN (vtysh_telnet, vtysh_telnet_cmd, "telnet WORD", @@ -2110,6 +2111,7 @@ DEFUN (vtysh_start_zsh, execute_command ("zsh", 0, NULL, NULL); return CMD_SUCCESS; } +#endif static void vtysh_install_default (enum node_type node) @@ -2429,9 +2431,11 @@ vtysh_init_vty (void) install_element (VIEW_NODE, &vtysh_ping6_cmd); install_element (VIEW_NODE, &vtysh_traceroute6_cmd); #endif +#if defined(HAVE_SHELL_ACCESS) install_element (VIEW_NODE, &vtysh_telnet_cmd); install_element (VIEW_NODE, &vtysh_telnet_port_cmd); install_element (VIEW_NODE, &vtysh_ssh_cmd); +#endif install_element (ENABLE_NODE, &vtysh_ping_cmd); install_element (ENABLE_NODE, &vtysh_ping_ip_cmd); install_element (ENABLE_NODE, &vtysh_traceroute_cmd); @@ -2440,13 +2444,15 @@ vtysh_init_vty (void) install_element (ENABLE_NODE, &vtysh_ping6_cmd); install_element (ENABLE_NODE, &vtysh_traceroute6_cmd); #endif +#if defined(HAVE_SHELL_ACCESS) install_element (ENABLE_NODE, &vtysh_telnet_cmd); install_element (ENABLE_NODE, &vtysh_telnet_port_cmd); install_element (ENABLE_NODE, &vtysh_ssh_cmd); install_element (ENABLE_NODE, &vtysh_start_shell_cmd); install_element (ENABLE_NODE, &vtysh_start_bash_cmd); install_element (ENABLE_NODE, &vtysh_start_zsh_cmd); - +#endif + install_element (VIEW_NODE, &vtysh_show_memory_cmd); install_element (ENABLE_NODE, &vtysh_show_memory_cmd); -- 1.9.1 _______________________________________________ Quagga-dev mailing list [email protected] https://lists.quagga.net/mailman/listinfo/quagga-dev
