* Replaced luafilesystem with luaposix library

* Introduced privilege dropping capability
* Automatically drop privileges for "public" to "nobody/nogroup" (as defined in ffluci.uci)

diff --git a/Makefile b/Makefile
index 2e986d8cbc5508d2ce5e71c782931401d30b7444..a43766e6698c03916e5aee9e157416ffd64cff7d 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -4,9 +4,9 @@ LUAC_OPTIONS = -s
 FILES = 
 
 CFILES = ffluci/util.lua ffluci/http.lua ffluci/fs.lua \
-ffluci/model/uci.lua ffluci/config.lua ffluci/i18n.lua  \
-ffluci/template.lua ffluci/cbi.lua ffluci/dispatcher.lua \
-ffluci/menu.lua ffluci/init.lua ffluci/sys.lua 
+ffluci/sys.lua ffluci/model/uci.lua ffluci/config.lua \
+ffluci/i18n.lua ffluci/template.lua ffluci/cbi.lua \
+ffluci/dispatcher.lua ffluci/menu.lua ffluci/init.lua 
 
 DIRECTORIES = dist/ffluci/model/cbi dist/ffluci/controller dist/ffluci/i18n dist/ffluci/view
 

diff --git a/contrib/ffluci.uci b/contrib/ffluci.uci
index c887b1b33ed38bd0da87c5c6df0fead5c8a1bde9..640faf170392bd979c86dc2d5e8f8e91c48d66d9 100644 (file)
--- a/contrib/ffluci.uci
+++ b/contrib/ffluci.uci
@@ -2,6 +2,8 @@ config core main
         option lang de
         option mediaurlbase /ffluci/media
         
+config core category_privileges
+               option public nobody:nogroup
 
 config public contact
                option nickname

diff --git a/contrib/package/ffluci/Makefile b/contrib/package/ffluci/Makefile
index 04093a97486c6aeee91f917ecfed0119803c2806..4709767d16809f7aa1a13304ba936f3f6ba7c8c3 100644 (file)
--- a/contrib/package/ffluci/Makefile
+++ b/contrib/package/ffluci/Makefile
@@ -15,7 +15,7 @@ define Package/ffluci
   SECTION:=admin
   CATEGORY:=Administration
   TITLE:=FFLuCI
-  DEPENDS:=+liblua +luafilesystem +haserl
+  DEPENDS:=+liblua +luaposix +haserl
   MAINTAINER:=Steven Barth <steven-at-midlink-dot-org>
 endef
 

diff --git a/contrib/package/luafilesystem/Makefile b/contrib/package/luafilesystem/Makefile
deleted file mode 100644 (file)
index 6c73cf5..0000000
--- a/contrib/package/luafilesystem/Makefile
+++ /dev/null
@@ -1,44 +0,0 @@
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=luafilesystem
-PKG_VERSION:=1.4.0
-PKG_RELEASE:=1
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://luaforge.net/frs/download.php/3158
-PKG_MD5SUM:=6f3d247f27820b8f045431ad81bcd3ad
-
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-PKG_INSTALL_DIR:=$(PKG_BUILD_DIR)/ipkg-install
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/luafilesystem
-  SECTION:=lib
-  CATEGORY:=Libraries
-  TITLE:=Lua FS library
-  URL:=http://www.keplerproject.org/luafilesystem/
-  DEPENDS:=+liblua
-  MAINTAINER:=Steven Barth <steven-at-midlink-dot-org>
-endef
-
-define Build/Configure
-endef
-
-define Build/Compile
-       $(MAKE) -C $(PKG_BUILD_DIR) \
-               CC="$(TARGET_CROSS)gcc" \
-               LD="$(TARGET_CROSS)ld" \
-               AR="$(TARGET_CROSS)ar rcu" \
-               RANLIB="$(TARGET_CROSS)ranlib" \
-               INSTALL_ROOT=/usr \
-               LUA_INC=$(STAGING_DIR)/usr/include
-endef
-
-define Package/luafilesystem/install           
-       $(INSTALL_DIR) $(1)/usr/lib/lua
-       $(STRIP) $(PKG_BUILD_DIR)/src/lfs.so
-       $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/lfs.so $(1)/usr/lib/lua
-endef
-
-$(eval $(call BuildPackage,luafilesystem))

diff --git a/contrib/package/luaposix/Makefile b/contrib/package/luaposix/Makefile
new file mode 100644 (file)
index 0000000..177583b
--- /dev/null
+++ b/contrib/package/luaposix/Makefile
@@ -0,0 +1,44 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=luaposix
+PKG_VERSION:=5.1.2
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=http://luaforge.net/frs/download.php/3063
+PKG_MD5SUM:=31deeb4add91f76b3c2d36aae2888d81
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
+PKG_INSTALL_DIR:=$(PKG_BUILD_DIR)/ipkg-install
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/luaposix
+  SECTION:=lib
+  CATEGORY:=Libraries
+  TITLE:=Lua Posix library
+  URL:=http://luaforge.net/projects/luaposix/
+  DEPENDS:=+liblua
+  MAINTAINER:=Steven Barth <steven-at-midlink-dot-org>
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+       $(MAKE) -C $(PKG_BUILD_DIR) \
+               CC="$(TARGET_CROSS)gcc" \
+               LD="$(TARGET_CROSS)ld" \
+               AR="$(TARGET_CROSS)ar rcu" \
+               RANLIB="$(TARGET_CROSS)ranlib" \
+               INSTALL_ROOT=/usr \
+               LUAINC=$(STAGING_DIR)/usr/include
+endef
+
+define Package/luaposix/install                
+       $(INSTALL_DIR) $(1)/usr/lib/lua
+       $(STRIP) $(PKG_BUILD_DIR)/posix.so
+       $(INSTALL_BIN) $(PKG_BUILD_DIR)/posix.so $(1)/usr/lib/lua
+endef
+
+$(eval $(call BuildPackage,luaposix))
\ No newline at end of file

diff --git a/src/ffluci/cbi.lua b/src/ffluci/cbi.lua
index 296a77b493562ff221679693ece07b845d5cb67b..d89405516835bc326b33eab8b201436ad7176316 100644 (file)
--- a/src/ffluci/cbi.lua
+++ b/src/ffluci/cbi.lua
@@ -39,7 +39,7 @@ function load(cbimap)
        require("ffluci.fs")
        require("ffluci.i18n")
        
-       local cbidir = ffluci.fs.dirname(ffluci.util.__file__()) .. "model/cbi/"
+       local cbidir = ffluci.fs.dirname(ffluci.util.__file__()) .. "/model/cbi/"
        local func, err = loadfile(cbidir..cbimap..".lua")
        
        if not func then

diff --git a/src/ffluci/controller/admin/system.lua b/src/ffluci/controller/admin/system.lua
index df2d981e4c01b9e90d42983d0778f16075184c53..be2d9b6eb68f4d8f0ae13ded2f36dbaa5e371abd 100644 (file)
--- a/src/ffluci/controller/admin/system.lua
+++ b/src/ffluci/controller/admin/system.lua
@@ -1,6 +1,6 @@
 module("ffluci.controller.admin.system", package.seeall)
 
-require("ffluci.util")
+require("ffluci.sys")
 require("ffluci.http")
 
 menu = {
@@ -18,8 +18,7 @@ function action_passwd()
        local cm
        
        if p1 or p2 then
-               cm = "(echo '"..p1.."';sleep 1;echo '"..p2.."') | passwd root 2>&1"
-               msg = ffluci.util.exec(cm)
+               msg = ffluci.sys.user.setpasswd("root", p1, p2)
        end
        
        ffluci.template.render("admin_system/passwd", {msg=msg})

diff --git a/src/ffluci/dispatcher.lua b/src/ffluci/dispatcher.lua
index 139b0e308314853982fc65e0f36671239b941577..b60a9beefa3cbc0115c2d11bae0ea5ff71de17ea 100644 (file)
--- a/src/ffluci/dispatcher.lua
+++ b/src/ffluci/dispatcher.lua
@@ -84,8 +84,20 @@ limitations under the License.
 module("ffluci.dispatcher", package.seeall)
 require("ffluci.http")
 require("ffluci.template")
+require("ffluci.config")
+require("ffluci.sys")
 
 
+-- Sets privilege for given category
+function assign_privileges(category)
+       local cp = ffluci.config.category_privileges
+       if cp and cp[category] then
+               local u, g = cp[category]:match("([^:]+):([^:]+)")
+               ffluci.sys.process.setuser(u)
+               ffluci.sys.process.setgroup(g)
+       end
+end
+
 -- Dispatches the "request"
 function dispatch(req)
        request = req
@@ -137,6 +149,7 @@ function httpdispatch()
        local mod = sanitize(parts(), "index")
        local act = sanitize(parts(), "index")
        
+       assign_privileges(cat)
        dispatch({category=cat, module=mod, action=act})
 end
 

diff --git a/src/ffluci/fs.lua b/src/ffluci/fs.lua
index fdea1b51ec0d6b20933fca08e016de8e7bec6b74..1896122798a15aa082c385c66e239583c9cc2bf8 100644 (file)
--- a/src/ffluci/fs.lua
+++ b/src/ffluci/fs.lua
@@ -26,7 +26,7 @@ limitations under the License.
 
 module("ffluci.fs", package.seeall)
 
-require("lfs")
+require("posix")
 
 -- Checks whether a file exists
 function isfile(filename)
@@ -80,26 +80,28 @@ end
 
 -- Returns the file modification date/time of "path"
 function mtime(path)
-       return lfs.attributes(path, "modification")
+       return posix.stat(path, "mtime")
 end
 
--- Simplified dirname function
-function dirname(file)
-       return string.gsub(file, "[^/]+$", "")
+-- basename wrapper
+function basename(path)
+       return posix.basename(path)
+end
+
+-- dirname wrapper
+function dirname(path)
+       return posix.dirname(path)
 end
 
 -- Diriterator - alias for lfs.dir - filter . and ..
 function dir(path)
-       local e = {}
-       for entry in lfs.dir(path) do
-               if not(entry == "." or entry == "..") then
-                       table.insert(e, entry)
-               end
-       end
+       local e = posix.dir(path)
+       table.remove(e, 1)
+       table.remove(e, 1)
        return e
 end
 
 -- Alias for lfs.mkdir
 function mkdir(...)
-       return lfs.mkdir(...)
+       return posix.mkdir(...)
 end
\ No newline at end of file

diff --git a/src/ffluci/i18n.lua b/src/ffluci/i18n.lua
index 1abe22fd79f395c6a1ff2fc74d12ec527f5b4cf4..c362d3e5f06d2458a7aac3388ae88df103f5d22b 100644 (file)
--- a/src/ffluci/i18n.lua
+++ b/src/ffluci/i18n.lua
@@ -31,7 +31,7 @@ require("ffluci.util")
 require("ffluci.config")
 
 table   = {}
-i18ndir = ffluci.fs.dirname(ffluci.util.__file__()) .. "i18n/"
+i18ndir = ffluci.fs.dirname(ffluci.util.__file__()) .. "/i18n/"
 
 -- Clears the translation table
 function clear()

diff --git a/src/ffluci/menu.lua b/src/ffluci/menu.lua
index 7b192aaea906d09df4aad8536fd1c203a70eb408..724faaeaa60b3887a07d3fd3d63fbdf8be230c74 100644 (file)
--- a/src/ffluci/menu.lua
+++ b/src/ffluci/menu.lua
@@ -29,8 +29,8 @@ require("ffluci.fs")
 require("ffluci.util")
 require("ffluci.template")
 
-ctrldir   = ffluci.fs.dirname(ffluci.util.__file__()) .. "controller/"
-modelpath = ffluci.fs.dirname(ffluci.util.__file__()) .. "model/menudata.lua"
+ctrldir   = ffluci.fs.dirname(ffluci.util.__file__()) .. "/controller/"
+modelpath = ffluci.fs.dirname(ffluci.util.__file__()) .. "/model/menudata.lua"
 
 -- Cache menudata into a Luafile instead of recollecting it at every pageload
 -- Warning: Make sure the menudata cache gets deleted everytime you update

diff --git a/src/ffluci/sys.lua b/src/ffluci/sys.lua
index 4ed2262c8b2a1d244a7ecf05d4416b5bd3773fab..97a926b0b1bc2320e35b2bc8782b3781d2fd8347 100644 (file)
--- a/src/ffluci/sys.lua
+++ b/src/ffluci/sys.lua
@@ -25,7 +25,7 @@ limitations under the License.
 ]]--
 
 module("ffluci.sys", package.seeall)
-require("ffluci.fs")
+require("posix")
 
 -- Returns the hostname
 function hostname()
@@ -38,11 +38,40 @@ function loadavg()
        return loadavg:match("^(.-) (.-) (.-) (.-) (.-)$")
 end
 
+
+group = {}
+group.getgroup = posix.getgroup
+
+net = {}
 -- Returns all available network interfaces
-function net_devices()
+function net.devices()
        local devices = {}
        for line in io.lines("/proc/net/dev") do
                table.insert(devices, line:match(" *(.-):"))
        end
        return devices
+end
+
+process = {}
+process.info = posix.getpid 
+
+-- Sets the gid of a process
+function process.setgroup(pid, gid)
+       return posix.setpid("g", pid, gid)
+end
+
+-- Sets the uid of a process
+function process.setuser(pid, uid)
+       return posix.setpid("u", pid, uid)
+end
+
+user = {}
+-- returns user information to a given uid
+user.getuser = posix.getpasswd
+       
+-- Changes the user password of given user
+function user.setpasswd(user, pwd1, pwd2)
+       local cmd = "(echo '"..pwd1.."';sleep 1;echo '"..pwd2.."')|"
+       cmd = cmd .. "passwd "..user.." 2>&1"
+       return ffluci.util.exec(cmd)
 end
\ No newline at end of file

diff --git a/src/ffluci/template.lua b/src/ffluci/template.lua
index f7131488ef9f0061f261f80b4660ad689632f02a..2bc0150812e8f6a612e5bdaf4a1889ea0bbae04a 100644 (file)
--- a/src/ffluci/template.lua
+++ b/src/ffluci/template.lua
@@ -31,7 +31,7 @@ require("ffluci.fs")
 require("ffluci.i18n")
 require("ffluci.model.uci")
 
-viewdir = ffluci.fs.dirname(ffluci.util.__file__()) .. "view/"
+viewdir = ffluci.fs.dirname(ffluci.util.__file__()) .. "/view/"
 
 
 -- Compile modes:

diff --git a/src/ffluci/util.lua b/src/ffluci/util.lua
index 85092f065ce75e46fa5b855ec15d4c3b79946afc..c47a89895d42f36de108c773092ffe5b05f3efb3 100644 (file)
--- a/src/ffluci/util.lua
+++ b/src/ffluci/util.lua
@@ -150,6 +150,16 @@ function instanceof(object, class)
 end
 
 
+-- Creates valid XML PCDATA from a string
+function pcdata(value)
+       value = value:gsub("&", "&")        
+       value = value:gsub('"', """)
+       value = value:gsub("'", "'")
+       value = value:gsub("<", "&lt;") 
+       return value:gsub(">", "&gt;")
+end
+
+
 -- Resets the scope of f doing a shallow copy of its scope into a new table
 function resfenv(f)
        setfenv(f, clone(getfenv(f)))