Implement two types of suid/sgid support for BusyBox:

1) tinylogin like with compile time selection and a chown root.root
2) Runtime configurable via /etc/busybox.conf (docu is in the works)
[Parts of this patch may overlap with my other two patches]

diff --git a/applets/applets.c b/applets/applets.c
index f3e56a9f39b6563cd1dd88386223109561c708fe..2ab44059a2dff6fae2f2a2b5a21cf2eb42050dad 100644 (file)
--- a/applets/applets.c
+++ b/applets/applets.c
@@ -25,6 +25,7 @@
  *
  */
 
+#include <unistd.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -40,6 +41,42 @@ struct BB_applet *applet_using;
 /* The -1 arises because of the {0,NULL,0,-1} entry above. */
 const size_t NUM_APPLETS = (sizeof (applets) / sizeof (struct BB_applet) - 1);
 
+
+#ifdef CONFIG_FEATURE_SUID
+
+static void check_suid ( struct BB_applet *app );
+
+#ifdef CONFIG_FEATURE_SUID_CONFIG
+
+#include <sys/stat.h>
+#include <ctype.h>
+#include "pwd.h"
+#include "grp.h"
+
+static void parse_error ( int line, const char *err );
+static void parse_config_file ( void );
+
+#define CONFIG_FILE "/etc/busybox.conf"
+
+// applets [] is const, so we have to define this "override" structure
+struct BB_suid_config {
+       struct BB_applet *m_applet;
+
+       uid_t  m_uid;
+       gid_t  m_gid;
+       mode_t m_mode;
+       
+       struct BB_suid_config *m_next;
+};
+
+static struct BB_suid_config *suid_config;
+
+#endif // CONFIG_FEATURE_SUID_CONFIG
+
+#endif // CONFIG_FEATURE_SUID
+
+
+
 extern void show_usage(void)
 {
        const char *format_string;
@@ -80,6 +117,11 @@ void run_applet_by_name(const char *name, int argc, char **argv)
        static int recurse_level = 0;
        extern int been_there_done_that; /* From busybox.c */
 
+#ifdef CONFIG_FEATURE_SUID_CONFIG
+       if ( recurse_level == 0 )
+               parse_config_file ( );
+#endif
+
        recurse_level++;
        /* Do a binary search to find the applet entry given the name. */
        if ((applet_using = find_applet_by_name(name)) != NULL) {
@@ -96,6 +138,10 @@ void run_applet_by_name(const char *name, int argc, char **argv)
                        been_there_done_that=1;
                        busybox_main(0, NULL);
                }
+#ifdef CONFIG_FEATURE_SUID
+               check_suid ( applet_using );
+#endif
+                       
                exit((*(applet_using->main)) (argc, argv));
        }
        /* Just in case they have renamed busybox - Check argv[1] */
@@ -106,6 +152,247 @@ void run_applet_by_name(const char *name, int argc, char **argv)
 }
 
 
+#ifdef CONFIG_FEATURE_SUID
+
+#ifdef CONFIG_FEATURE_SUID_CONFIG
+
+// check if u is member of group g
+static int ingroup ( uid_t u, gid_t g )
+{
+       struct group *grp = getgrgid ( g );
+       
+       if ( grp ) {
+               char **mem;
+               
+               for ( mem = grp-> gr_mem; *mem; mem++ ) {
+                       struct passwd *pwd = getpwnam ( *mem );
+               
+                       if ( pwd && ( pwd-> pw_uid == u ))
+                               return 1;
+               }
+       }
+       return 0;
+}
+
+#endif
+
+
+void check_suid ( struct BB_applet *applet )
+{
+       uid_t ruid = getuid ( ); // real [ug]id
+       uid_t rgid = getgid ( );
+                       
+#ifdef CONFIG_FEATURE_SUID_CONFIG
+       struct BB_suid_config *sct;
+       
+       for ( sct = suid_config; sct; sct = sct-> m_next ) {
+               if ( sct-> m_applet == applet )
+                       break;
+       }               
+       if ( sct ) {
+               mode_t m = sct-> m_mode;
+               
+               if ( sct-> m_uid == ruid ) // same uid
+                       m >>= 6;
+               else if (( sct-> m_gid == rgid ) || ingroup ( ruid, sct-> m_gid )) // same group / in group
+                       m >>= 3;
+
+               if (!( m & S_IXOTH ))   // is x bit not set ?
+                       error_msg_and_die ( "You have no permission to run this applet!" );
+       
+               if (( sct-> m_mode & ( S_ISGID | S_IXGRP )) == ( S_ISGID | S_IXGRP )) { // *both* have to be set for sgid
+                       if ( setegid ( sct-> m_gid ))
+                               error_msg_and_die ( "BusyBox binary has insufficient rights to set proper GID for applet!" );
+               }
+               else
+                       setgid ( rgid ); // no sgid -> drop
+                       
+               if ( sct-> m_mode & S_ISUID ) {
+                       if ( seteuid ( sct-> m_uid ))
+                               error_msg_and_die ( "BusyBox binary has insufficient rights to set proper UID for applet!" );
+               }       
+               else
+                       setuid ( ruid ); // no suid -> drop
+       }
+       else { // default: drop all priviledges
+               setgid ( rgid );
+               setuid ( ruid );
+       }
+#else
+
+       if ( applet-> need_suid == _BB_SUID_ALWAYS ) {
+               if ( geteuid ( ) != 0 ) 
+                       error_msg_and_die ( "This applet requires root priviledges!" );
+       } 
+       else if ( applet-> need_suid == _BB_SUID_NEVER ) {
+               setgid ( rgid ); // drop all priviledges
+               setuid ( ruid );
+       }       
+#endif 
+}
+
+#ifdef CONFIG_FEATURE_SUID_CONFIG
+
+void parse_error ( int line, const char *err )
+{
+       char msg [512];
+       snprintf ( msg, sizeof( msg ) - 1, "Parse error in %s, line %d: %s", CONFIG_FILE, line, err );
+
+       error_msg_and_die ( msg );
+}
+
+
+void parse_config_file ( void )
+{
+       struct stat st;
+
+       suid_config = 0;
+       
+       // is there a config file ?
+       if ( stat ( CONFIG_FILE, &st ) == 0 ) {
+               // is it owned by root with no write perm. for group and others ?
+               if ( S_ISREG( st. st_mode ) && ( st. st_uid == 0 )      && (!( st. st_mode & ( S_IWGRP | S_IWOTH )))) {
+                       // that's ok .. then try to open it
+                       FILE *f = fopen ( CONFIG_FILE, "r" );
+
+                       if ( f ) {
+                               char buffer [4096];
+                               int section = 0;
+                               int lc = 0;
+                               
+                               while ( fgets ( buffer, sizeof( buffer ) - 1, f )) {
+                                       char c = buffer [0];
+                                       char *p;
+                               
+                                       lc++;
+                                       
+                                       p = strchr ( buffer, '#' );
+                                       if ( p )
+                                               *p = 0;
+                                       p = buffer + xstrlen ( buffer );
+                                       while (( p > buffer ) && isspace ( *--p ))
+                                               *p = 0;         
+                                               
+                                       if ( p == buffer )
+                                               continue;                                       
+                               
+                                       if ( c == '[' ) {
+                                               p = strchr ( buffer, ']' );
+                                               
+                                               if ( !p || ( p == ( buffer + 1 )))  // no matching ] or empty []
+                                                       parse_error ( lc, "malformed section header" );
+
+                                               *p = 0;
+                                               
+                                               if ( strcasecmp ( buffer + 1, "SUID" ) == 0 )
+                                                       section = 1;
+                                               else
+                                                       section = -1; // unknown section - just skip
+                                       }
+                                       else if ( section ) {
+                                               switch ( section ) {
+                                                       case 1: { // SUID
+                                                               int l;
+                                                               struct BB_applet *applet;
+
+                                                               p = strchr ( buffer, '=' ); // <key>[::space::]*=[::space::]*<value>
+                                                               
+                                                               if ( !p || ( p == ( buffer + 1 ))) // no = or key is empty
+                                                                       parse_error ( lc, "malformed keyword" );
+                                                               
+                                                               l = p - buffer;
+                                                               while ( isspace ( buffer [--l] )) { } // skip whitespace
+                                                               
+                                                               buffer [l+1] = 0;
+                                                               
+                                                               if (( applet = find_applet_by_name ( buffer ))) {
+                                                                       struct BB_suid_config *sct = xmalloc ( sizeof( struct BB_suid_config ));
+                                                                       
+                                                                       sct-> m_applet = applet;
+                                                                       sct-> m_next = suid_config;
+                                                                       suid_config = sct;
+                                                                       
+                                                                       while ( isspace ( *++p )) { } // skip whitespace
+                                                                                               
+                                                                       sct-> m_mode = 0;                       
+                                                                       
+                                                                       switch ( *p++ ) {
+                                                                               case 'S': sct-> m_mode |= S_ISUID; break;
+                                                                               case 's': sct-> m_mode |= S_ISUID; // no break
+                                                                               case 'x': sct-> m_mode |= S_IXUSR; break;
+                                                                               case '-': break;
+                                                                               default : parse_error ( lc, "invalid user mode" );
+                                                                       }
+                                                                               
+                                                                       switch ( *p++ ) {
+                                                                               case 's': sct-> m_mode |= S_ISGID; // no break
+                                                                               case 'x': sct-> m_mode |= S_IXGRP; break;
+                                                                               case 'S': break;
+                                                                               case '-': break;
+                                                                               default : parse_error ( lc, "invalid group mode" );
+                                                                       }
+                                                                               
+                                                                       switch ( *p ) {
+                                                                               case 't': 
+                                                                               case 'x': sct-> m_mode |= S_IXOTH; break;
+                                                                               case 'T':
+                                                                               case '-': break;
+                                                                               default : parse_error ( lc, "invalid other mode" );
+                                                                       }
+                                                                               
+                                                                       while ( isspace ( *++p )) { } // skip whitespace
+                                                                       
+                                                                       if ( isdigit ( *p )) {
+                                                                               sct-> m_uid = strtol ( p, &p, 10 );
+                                                                               if ( *p++ != '.' )
+                                                                                       parse_error ( lc, "parsing <uid>.<gid>" );                                                                              
+                                                                       }
+                                                                       else {
+                                                                               struct passwd *pwd;
+                                                                               char *p2 = strchr ( p, '.' );
+                                                                               
+                                                                               if ( !p2 ) 
+                                                                                       parse_error ( lc, "parsing <uid>.<gid>" );                                                                              
+       
+                                                                               *p2 = 0;
+                                                                               pwd = getpwnam ( p );
+                                               
+                                                                               if ( !pwd ) 
+                                                                                       parse_error ( lc, "invalid user name" );
+                                                                               
+                                                                               sct-> m_uid = pwd-> pw_uid;
+                                                                               p = p2 + 1;
+                                                                       }               
+                                                                       if ( isdigit ( *p )) 
+                                                                               sct-> m_gid = strtol ( p, &p, 10 );
+                                                                       else {
+                                                                               struct group *grp = getgrnam ( p );
+                                               
+                                                                               if ( !grp ) 
+                                                                                       parse_error ( lc, "invalid group name" );
+                                                                               
+                                                                               sct-> m_gid = grp-> gr_gid;
+                                                                       }                                                                                                                                               
+                                                               }
+                                                               break;
+                                                       }
+                                                       default: // unknown - skip
+                                                               break;
+                                               }                                       
+                                       }
+                                       else
+                                               parse_error ( lc, "keyword not within section" );
+                               }                               
+                               fclose ( f );
+                       }
+               }
+       }
+}
+
+#endif
+
+#endif
+
 /* END CODE */
 /*
 Local Variables:

diff --git a/include/applets.h b/include/applets.h
index 6d01901a3c127cbaba8997eca857fe968144d558..3a8c731a554624bb2361d3836f222752b4c235c8 100644 (file)
--- a/include/applets.h
+++ b/include/applets.h
@@ -16,515 +16,521 @@
 
 
 #if defined(PROTOTYPES)
-  #define APPLET(a,b,c) extern int b(int argc, char **argv);
-  #define APPLET_NOUSAGE(a,b,c) extern int b(int argc, char **argv);
-  #define APPLET_ODDNAME(a,b,c,d) extern int b(int argc, char **argv);
+  #define APPLET(a,b,c,d) extern int b(int argc, char **argv);
+  #define APPLET_NOUSAGE(a,b,c,d) extern int b(int argc, char **argv);
+  #define APPLET_ODDNAME(a,b,c,d,e) extern int b(int argc, char **argv);
   extern const char usage_messages[];
 #elif defined(MAKE_USAGE)
   #ifdef CONFIG_FEATURE_VERBOSE_USAGE
-    #define APPLET(a,b,c) a##_trivial_usage "\n\n" a##_full_usage "\0"
-    #define APPLET_NOUSAGE(a,b,c) "\0"
-    #define APPLET_ODDNAME(a,b,c,d) d##_trivial_usage "\n\n" d##_full_usage "\0"
+    #define APPLET(a,b,c,d) a##_trivial_usage "\n\n" a##_full_usage "\0"
+    #define APPLET_NOUSAGE(a,b,c,d) "\0"
+    #define APPLET_ODDNAME(a,b,c,d,e) e##_trivial_usage "\n\n" e##_full_usage "\0"
   #else
-    #define APPLET(a,b,c) a##_trivial_usage "\0"
-    #define APPLET_NOUSAGE(a,b,c) "\0"
-    #define APPLET_ODDNAME(a,b,c,d) d##_trivial_usage "\0"
+    #define APPLET(a,b,c,d) a##_trivial_usage "\0"
+    #define APPLET_NOUSAGE(a,b,c,d) "\0"
+    #define APPLET_ODDNAME(a,b,c,d,e) e##_trivial_usage "\0"
   #endif
 #elif defined(MAKE_LINKS)
-#  define APPLET(a,b,c) LINK c a
-#  define APPLET_NOUSAGE(a,b,c) LINK c a
-#  define APPLET_ODDNAME(a,b,c,d) LINK c a
+#  define APPLET(a,b,c,d) LINK c a
+#  define APPLET_NOUSAGE(a,b,c,d) LINK c a
+#  define APPLET_ODDNAME(a,b,c,d,e) LINK c a
 #else
   const struct BB_applet applets[] = {
-  #define APPLET(a,b,c) {#a,b,c},
-  #define APPLET_NOUSAGE(a,b,c) {a,b,c},
-  #define APPLET_ODDNAME(a,b,c,d) {a,b,c},
+  #define APPLET(a,b,c,d) {#a,b,c,d},
+  #define APPLET_NOUSAGE(a,b,c,d) {a,b,c,d},
+  #define APPLET_ODDNAME(a,b,c,d,e) {a,b,c,d},
 #endif
 
 
 
 #ifdef CONFIG_TEST
-       APPLET_NOUSAGE("[", test_main, _BB_DIR_USR_BIN)
+       APPLET_NOUSAGE("[", test_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ADDGROUP
-       APPLET(addgroup, addgroup_main, _BB_DIR_BIN)
+       APPLET(addgroup, addgroup_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ADDUSER
-       APPLET(adduser, adduser_main, _BB_DIR_BIN)
+       APPLET(adduser, adduser_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ADJTIMEX
-       APPLET(adjtimex, adjtimex_main, _BB_DIR_SBIN)
+       APPLET(adjtimex, adjtimex_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_AR
-       APPLET(ar, ar_main, _BB_DIR_USR_BIN)
+       APPLET(ar, ar_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ASH
-       APPLET_NOUSAGE("ash", ash_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("ash", ash_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_BASENAME
-       APPLET(basename, basename_main, _BB_DIR_USR_BIN)
+       APPLET(basename, basename_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_BUNZIP2
-       APPLET(bunzip2, bunzip2_main, _BB_DIR_USR_BIN)
+       APPLET(bunzip2, bunzip2_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
-       APPLET_NOUSAGE("busybox", busybox_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("busybox", busybox_main, _BB_DIR_BIN, _BB_SUID_MAYBE)
 #ifdef CONFIG_BUNZIP2
-       APPLET(bzcat, bunzip2_main, _BB_DIR_USR_BIN)
+       APPLET(bzcat, bunzip2_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CAL
-       APPLET(cal, cal_main, _BB_DIR_USR_BIN)
+       APPLET(cal, cal_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CAT
-       APPLET(cat, cat_main, _BB_DIR_BIN)
+       APPLET(cat, cat_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CHGRP
-       APPLET(chgrp, chgrp_main, _BB_DIR_BIN)
+       APPLET(chgrp, chgrp_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CHMOD
-       APPLET(chmod, chmod_main, _BB_DIR_BIN)
+       APPLET(chmod, chmod_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CHOWN
-       APPLET(chown, chown_main, _BB_DIR_BIN)
+       APPLET(chown, chown_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CHROOT
-       APPLET(chroot, chroot_main, _BB_DIR_USR_SBIN)
+       APPLET(chroot, chroot_main, _BB_DIR_USR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CHVT
-       APPLET(chvt, chvt_main, _BB_DIR_USR_BIN)
+       APPLET(chvt, chvt_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CLEAR
-       APPLET(clear, clear_main, _BB_DIR_USR_BIN)
+       APPLET(clear, clear_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CMP
-       APPLET(cmp, cmp_main, _BB_DIR_USR_BIN)
+       APPLET(cmp, cmp_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CP
-       APPLET(cp, cp_main, _BB_DIR_BIN)
+       APPLET(cp, cp_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CPIO
-       APPLET(cpio, cpio_main, _BB_DIR_BIN)
+       APPLET(cpio, cpio_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_CUT
-       APPLET(cut, cut_main, _BB_DIR_USR_BIN)
+       APPLET(cut, cut_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DATE
-       APPLET(date, date_main, _BB_DIR_BIN)
+       APPLET(date, date_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DC
-       APPLET(dc, dc_main, _BB_DIR_USR_BIN)
+       APPLET(dc, dc_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DD
-       APPLET(dd, dd_main, _BB_DIR_BIN)
+       APPLET(dd, dd_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DEALLOCVT
-       APPLET(deallocvt, deallocvt_main, _BB_DIR_USR_BIN)
+       APPLET(deallocvt, deallocvt_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DELGROUP
-       APPLET(delgroup, delgroup_main, _BB_DIR_BIN)
+       APPLET(delgroup, delgroup_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DELUSER
-       APPLET(deluser, deluser_main, _BB_DIR_BIN)
+       APPLET(deluser, deluser_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DF
-       APPLET(df, df_main, _BB_DIR_BIN)
+       APPLET(df, df_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DIRNAME
-       APPLET(dirname, dirname_main, _BB_DIR_USR_BIN)
+       APPLET(dirname, dirname_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DMESG
-       APPLET(dmesg, dmesg_main, _BB_DIR_BIN)
+       APPLET(dmesg, dmesg_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DOS2UNIX
-       APPLET(dos2unix, dos2unix_main, _BB_DIR_USR_BIN)
+       APPLET(dos2unix, dos2unix_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DPKG
-       APPLET(dpkg, dpkg_main, _BB_DIR_USR_BIN)
+       APPLET(dpkg, dpkg_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DPKG_DEB
-       APPLET_ODDNAME("dpkg-deb", dpkg_deb_main, _BB_DIR_USR_BIN, dpkg_deb)
+       APPLET_ODDNAME("dpkg-deb", dpkg_deb_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER, dpkg_deb)
 #endif
 #ifdef CONFIG_DU
-       APPLET(du, du_main, _BB_DIR_USR_BIN)
+       APPLET(du, du_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DUMPKMAP
-       APPLET(dumpkmap, dumpkmap_main, _BB_DIR_BIN)
+       APPLET(dumpkmap, dumpkmap_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_DUTMP
-       APPLET(dutmp, dutmp_main, _BB_DIR_USR_SBIN)
+       APPLET(dutmp, dutmp_main, _BB_DIR_USR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ECHO
-       APPLET(echo, echo_main, _BB_DIR_BIN)
+       APPLET(echo, echo_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #if defined(CONFIG_FEATURE_GREP_EGREP_ALIAS)
-       APPLET_NOUSAGE("egrep", grep_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("egrep", grep_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ENV
-       APPLET(env, env_main, _BB_DIR_USR_BIN)
+       APPLET(env, env_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_EXPR
-       APPLET(expr, expr_main, _BB_DIR_USR_BIN)
+       APPLET(expr, expr_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FALSE
-       APPLET(false, false_main, _BB_DIR_BIN)
+       APPLET(false, false_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FBSET
-       APPLET(fbset, fbset_main, _BB_DIR_USR_SBIN)
+       APPLET(fbset, fbset_main, _BB_DIR_USR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FDFLUSH
-       APPLET(fdflush, fdflush_main, _BB_DIR_BIN)
+       APPLET(fdflush, fdflush_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FIND
-       APPLET(find, find_main, _BB_DIR_USR_BIN)
+       APPLET(find, find_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FREE
-       APPLET(free, free_main, _BB_DIR_USR_BIN)
+       APPLET(free, free_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FREERAMDISK
-       APPLET(freeramdisk, freeramdisk_main, _BB_DIR_SBIN)
+       APPLET(freeramdisk, freeramdisk_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FSCK_MINIX
-       APPLET_ODDNAME("fsck.minix", fsck_minix_main, _BB_DIR_SBIN, fsck_minix)
+       APPLET_ODDNAME("fsck.minix", fsck_minix_main, _BB_DIR_SBIN, _BB_SUID_NEVER, fsck_minix)
 #endif
 #ifdef CONFIG_GETOPT
-       APPLET(getopt, getopt_main, _BB_DIR_BIN)
+       APPLET(getopt, getopt_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_GETTY
-       APPLET(getty, getty_main, _BB_DIR_SBIN)
+       APPLET(getty, getty_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_GREP
-       APPLET(grep, grep_main, _BB_DIR_BIN)
+       APPLET(grep, grep_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_GUNZIP
-       APPLET(gunzip, gunzip_main, _BB_DIR_BIN)
+       APPLET(gunzip, gunzip_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_GZIP
-       APPLET(gzip, gzip_main, _BB_DIR_BIN)
+       APPLET(gzip, gzip_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_HALT
-       APPLET(halt, halt_main, _BB_DIR_SBIN)
+       APPLET(halt, halt_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_HEAD
-       APPLET(head, head_main, _BB_DIR_USR_BIN)
+       APPLET(head, head_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_HEXDUMP
-       APPLET(hexdump, hexdump_main, _BB_DIR_USR_BIN)
+       APPLET(hexdump, hexdump_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_HOSTID
-       APPLET(hostid, hostid_main, _BB_DIR_USR_BIN)
+       APPLET(hostid, hostid_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_HOSTNAME
-       APPLET(hostname, hostname_main, _BB_DIR_BIN)
+       APPLET(hostname, hostname_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_HUSH
-       APPLET_NOUSAGE("hush", hush_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("hush", hush_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ID
-       APPLET(id, id_main, _BB_DIR_USR_BIN)
+       APPLET(id, id_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_IFCONFIG
-       APPLET(ifconfig, ifconfig_main, _BB_DIR_SBIN)
+       APPLET(ifconfig, ifconfig_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_INIT
-       APPLET(init, init_main, _BB_DIR_SBIN)
+       APPLET(init, init_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_INSMOD
-       APPLET(insmod, insmod_main, _BB_DIR_SBIN)
+       APPLET(insmod, insmod_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_KILL
-       APPLET(kill, kill_main, _BB_DIR_BIN)
+       APPLET(kill, kill_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_KILLALL
-       APPLET(killall, kill_main, _BB_DIR_USR_BIN)
+       APPLET(killall, kill_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_KLOGD
-       APPLET(klogd, klogd_main, _BB_DIR_SBIN)
+       APPLET(klogd, klogd_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LASH
-       APPLET(lash, lash_main, _BB_DIR_BIN)
+       APPLET(lash, lash_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LENGTH
-       APPLET(length, length_main, _BB_DIR_USR_BIN)
+       APPLET(length, length_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_FEATURE_INITRD
-       APPLET_NOUSAGE("linuxrc", init_main, _BB_DIR_ROOT)
+       APPLET_NOUSAGE("linuxrc", init_main, _BB_DIR_ROOT, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LN
-       APPLET(ln, ln_main, _BB_DIR_BIN)
+       APPLET(ln, ln_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOADACM
-       APPLET(loadacm, loadacm_main, _BB_DIR_USR_BIN)
+       APPLET(loadacm, loadacm_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOADFONT
-       APPLET(loadfont, loadfont_main, _BB_DIR_USR_BIN)
+       APPLET(loadfont, loadfont_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOADKMAP
-       APPLET(loadkmap, loadkmap_main, _BB_DIR_SBIN)
+       APPLET(loadkmap, loadkmap_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOGGER
-       APPLET(logger, logger_main, _BB_DIR_USR_BIN)
+       APPLET(logger, logger_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
+#endif
+#ifdef CONFIG_LOGIN
+       APPLET(login, login_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOGNAME
-       APPLET(logname, logname_main, _BB_DIR_USR_BIN)
+       APPLET(logname, logname_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOGREAD
-       APPLET(logread, logread_main, _BB_DIR_SBIN)
+       APPLET(logread, logread_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LOSETUP
-       APPLET(losetup, losetup_main, _BB_DIR_SBIN)
+       APPLET(losetup, losetup_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LS
-       APPLET(ls, ls_main, _BB_DIR_BIN)
+       APPLET(ls, ls_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_LSMOD
-       APPLET(lsmod, lsmod_main, _BB_DIR_SBIN)
+       APPLET(lsmod, lsmod_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MAKEDEVS
-       APPLET(makedevs, makedevs_main, _BB_DIR_SBIN)
+       APPLET(makedevs, makedevs_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MD5SUM
-       APPLET(md5sum, md5sum_main, _BB_DIR_USR_BIN)
+       APPLET(md5sum, md5sum_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MKDIR
-       APPLET(mkdir, mkdir_main, _BB_DIR_BIN)
+       APPLET(mkdir, mkdir_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MKFIFO
-       APPLET(mkfifo, mkfifo_main, _BB_DIR_USR_BIN)
+       APPLET(mkfifo, mkfifo_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MKFS_MINIX
-       APPLET_ODDNAME("mkfs.minix", mkfs_minix_main, _BB_DIR_SBIN, mkfs_minix)
+       APPLET_ODDNAME("mkfs.minix", mkfs_minix_main, _BB_DIR_SBIN, _BB_SUID_NEVER, mkfs_minix)
 #endif
 #ifdef CONFIG_MKNOD
-       APPLET(mknod, mknod_main, _BB_DIR_BIN)
+       APPLET(mknod, mknod_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MKSWAP
-       APPLET(mkswap, mkswap_main, _BB_DIR_SBIN)
+       APPLET(mkswap, mkswap_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MKTEMP
-       APPLET(mktemp, mktemp_main, _BB_DIR_BIN)
+       APPLET(mktemp, mktemp_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MODPROBE
-       APPLET(modprobe, modprobe_main, _BB_DIR_SBIN)
+       APPLET(modprobe, modprobe_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MORE
-       APPLET(more, more_main, _BB_DIR_BIN)
+       APPLET(more, more_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MOUNT
-       APPLET(mount, mount_main, _BB_DIR_BIN)
+       APPLET(mount, mount_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MSH
-       APPLET_NOUSAGE("msh", msh_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("msh", msh_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MT
-       APPLET(mt, mt_main, _BB_DIR_BIN)
+       APPLET(mt, mt_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_MV
-       APPLET(mv, mv_main, _BB_DIR_BIN)
+       APPLET(mv, mv_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_NC
-       APPLET(nc, nc_main, _BB_DIR_USR_BIN)
+       APPLET(nc, nc_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_NETSTAT
-       APPLET(netstat, netstat_main, _BB_DIR_BIN)
+       APPLET(netstat, netstat_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_NSLOOKUP
-       APPLET(nslookup, nslookup_main, _BB_DIR_USR_BIN)
+       APPLET(nslookup, nslookup_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_OD
-       APPLET(od, od_main, _BB_DIR_USR_BIN)
+       APPLET(od, od_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_PIDOF
-       APPLET(pidof, pidof_main, _BB_DIR_BIN)
+       APPLET(pidof, pidof_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_PING
-       APPLET(ping, ping_main, _BB_DIR_BIN)
+       APPLET(ping, ping_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_PIVOT_ROOT
-       APPLET(pivot_root, pivot_root_main, _BB_DIR_SBIN)
+       APPLET(pivot_root, pivot_root_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_POWEROFF
-       APPLET(poweroff, poweroff_main, _BB_DIR_SBIN)
+       APPLET(poweroff, poweroff_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_PRINTF
-       APPLET(printf, printf_main, _BB_DIR_USR_BIN)
+       APPLET(printf, printf_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_PS
-       APPLET(ps, ps_main, _BB_DIR_BIN)
+       APPLET(ps, ps_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_PWD
-       APPLET(pwd, pwd_main, _BB_DIR_BIN)
+       APPLET(pwd, pwd_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RDATE
-       APPLET(rdate, rdate_main, _BB_DIR_USR_BIN)
+       APPLET(rdate, rdate_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_READLINK
-       APPLET(readlink, readlink_main, _BB_DIR_USR_BIN)
+       APPLET(readlink, readlink_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_REBOOT
-       APPLET(reboot, reboot_main, _BB_DIR_SBIN)
+       APPLET(reboot, reboot_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RENICE
-       APPLET(renice, renice_main, _BB_DIR_USR_BIN)
+       APPLET(renice, renice_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RESET
-       APPLET(reset, reset_main, _BB_DIR_USR_BIN)
+       APPLET(reset, reset_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RM
-       APPLET(rm, rm_main, _BB_DIR_BIN)
+       APPLET(rm, rm_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RMDIR
-       APPLET(rmdir, rmdir_main, _BB_DIR_BIN)
+       APPLET(rmdir, rmdir_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RMMOD
-       APPLET(rmmod, rmmod_main, _BB_DIR_SBIN)
+       APPLET(rmmod, rmmod_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_ROUTE
-       APPLET(route, route_main, _BB_DIR_SBIN)
+       APPLET(route, route_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RPM2CPIO
-       APPLET(rpm2cpio, rpm2cpio_main, _BB_DIR_USR_BIN)
+       APPLET(rpm2cpio, rpm2cpio_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_RUN_PARTS
-       APPLET_ODDNAME("run-parts", run_parts_main, _BB_DIR_BIN, run_parts)
+       APPLET_ODDNAME("run-parts", run_parts_main, _BB_DIR_BIN, _BB_SUID_NEVER, run_parts)
 #endif 
 #ifdef CONFIG_SED
-       APPLET(sed, sed_main, _BB_DIR_BIN)
+       APPLET(sed, sed_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_SETKEYCODES
-       APPLET(setkeycodes, setkeycodes_main, _BB_DIR_USR_BIN)
+       APPLET(setkeycodes, setkeycodes_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #if defined(CONFIG_FEATURE_SH_IS_ASH) && defined(CONFIG_ASH)
-       APPLET_NOUSAGE("sh", ash_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("sh", ash_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #elif defined(CONFIG_FEATURE_SH_IS_HUSH) && defined(CONFIG_HUSH)
-       APPLET_NOUSAGE("sh", hush_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("sh", hush_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #elif defined(CONFIG_FEATURE_SH_IS_LASH) && defined(CONFIG_LASH)
-       APPLET_NOUSAGE("sh", lash_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("sh", lash_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #elif defined(CONFIG_FEATURE_SH_IS_MSH) && defined(CONFIG_MSH)
-       APPLET_NOUSAGE("sh", msh_main, _BB_DIR_BIN)
+       APPLET_NOUSAGE("sh", msh_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_SLEEP
-       APPLET(sleep, sleep_main, _BB_DIR_BIN)
+       APPLET(sleep, sleep_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_SORT
-       APPLET(sort, sort_main, _BB_DIR_USR_BIN)
+       APPLET(sort, sort_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_START_STOP_DAEMON
-    APPLET_ODDNAME("start-stop-daemon", start_stop_daemon_main, _BB_DIR_SBIN, start_stop_daemon)
+    APPLET_ODDNAME("start-stop-daemon", start_stop_daemon_main, _BB_DIR_SBIN, _BB_SUID_NEVER, start_stop_daemon)
 #endif
 #ifdef CONFIG_STTY
-       APPLET(stty, stty_main, _BB_DIR_BIN)
+       APPLET(stty, stty_main, _BB_DIR_BIN, _BB_SUID_NEVER)
+#endif
+#ifdef CONFIG_SU
+       APPLET(su, su_main, _BB_DIR_BIN, _BB_SUID_ALWAYS)
 #endif
 #ifdef CONFIG_SWAPONOFF
-       APPLET(swapoff, swap_on_off_main, _BB_DIR_SBIN)
+       APPLET(swapoff, swap_on_off_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_SWAPONOFF
-       APPLET(swapon, swap_on_off_main, _BB_DIR_SBIN)
+       APPLET(swapon, swap_on_off_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_SYNC
-       APPLET(sync, sync_main, _BB_DIR_BIN)
+       APPLET(sync, sync_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_SYSLOGD
-       APPLET(syslogd, syslogd_main, _BB_DIR_SBIN)
+       APPLET(syslogd, syslogd_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TAIL
-       APPLET(tail, tail_main, _BB_DIR_USR_BIN)
+       APPLET(tail, tail_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TAR
-       APPLET(tar, tar_main, _BB_DIR_BIN)
+       APPLET(tar, tar_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TEE
-       APPLET(tee, tee_main, _BB_DIR_USR_BIN)
+       APPLET(tee, tee_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TELNET
-       APPLET(telnet, telnet_main, _BB_DIR_USR_BIN)
+       APPLET(telnet, telnet_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TEST
-       APPLET(test, test_main, _BB_DIR_USR_BIN)
+       APPLET(test, test_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TFTP
-       APPLET(tftp, tftp_main, _BB_DIR_USR_BIN)
+       APPLET(tftp, tftp_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TIME
-       APPLET(time, time_main, _BB_DIR_USR_BIN)
+       APPLET(time, time_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TOUCH
-       APPLET(touch, touch_main, _BB_DIR_BIN)
+       APPLET(touch, touch_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TR
-       APPLET(tr, tr_main, _BB_DIR_USR_BIN)
+       APPLET(tr, tr_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TRACEROUTE
-       APPLET(traceroute, traceroute_main, _BB_DIR_USR_BIN)
+       APPLET(traceroute, traceroute_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TRUE
-       APPLET(true, true_main, _BB_DIR_BIN)
+       APPLET(true, true_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_TTY
-       APPLET(tty, tty_main, _BB_DIR_USR_BIN)
+       APPLET(tty, tty_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UMOUNT
-       APPLET(umount, umount_main, _BB_DIR_BIN)
+       APPLET(umount, umount_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UNAME
-       APPLET(uname, uname_main, _BB_DIR_BIN)
+       APPLET(uname, uname_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_GUNZIP   
 # ifdef CONFIG_FEATURE_UNCOMPRESS
-       APPLET_ODDNAME("uncompress", gunzip_main, _BB_DIR_BIN, gunzip)
+       APPLET_ODDNAME("uncompress", gunzip_main, _BB_DIR_BIN, _BB_SUID_NEVER, gunzip)
 # endif
 #endif
 #ifdef CONFIG_UNIQ
-       APPLET(uniq, uniq_main, _BB_DIR_USR_BIN)
+       APPLET(uniq, uniq_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UNIX2DOS
-       APPLET(unix2dos, dos2unix_main, _BB_DIR_USR_BIN)
+       APPLET(unix2dos, dos2unix_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UNZIP
-       APPLET(unzip, unzip_main, _BB_DIR_USR_BIN)
+       APPLET(unzip, unzip_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UPDATE
-       APPLET(update, update_main, _BB_DIR_SBIN)
+       APPLET(update, update_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UPTIME
-       APPLET(uptime, uptime_main, _BB_DIR_USR_BIN)
+       APPLET(uptime, uptime_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_USLEEP
-       APPLET(usleep, usleep_main, _BB_DIR_BIN)
+       APPLET(usleep, usleep_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UUDECODE
-       APPLET(uudecode, uudecode_main, _BB_DIR_USR_BIN)
+       APPLET(uudecode, uudecode_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_UUENCODE
-       APPLET(uuencode, uuencode_main, _BB_DIR_USR_BIN)
+       APPLET(uuencode, uuencode_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_VI
-       APPLET(vi, vi_main, _BB_DIR_BIN)
+       APPLET(vi, vi_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_WATCHDOG
-       APPLET(watchdog, watchdog_main, _BB_DIR_SBIN)
+       APPLET(watchdog, watchdog_main, _BB_DIR_SBIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_WC
-       APPLET(wc, wc_main, _BB_DIR_USR_BIN)
+       APPLET(wc, wc_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_WGET
-       APPLET(wget, wget_main, _BB_DIR_USR_BIN)
+       APPLET(wget, wget_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_WHICH
-       APPLET(which, which_main, _BB_DIR_USR_BIN)
+       APPLET(which, which_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_WHO
-       APPLET(who, who_main, _BB_DIR_USR_BIN)
+       APPLET(who, who_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_WHOAMI
-       APPLET(whoami, whoami_main, _BB_DIR_USR_BIN)
+       APPLET(whoami, whoami_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_XARGS
-       APPLET(xargs, xargs_main, _BB_DIR_USR_BIN)
+       APPLET(xargs, xargs_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_YES
-       APPLET(yes, yes_main, _BB_DIR_USR_BIN)
+       APPLET(yes, yes_main, _BB_DIR_USR_BIN, _BB_SUID_NEVER)
 #endif
 #ifdef CONFIG_GUNZIP
-       APPLET(zcat, gunzip_main, _BB_DIR_BIN)
+       APPLET(zcat, gunzip_main, _BB_DIR_BIN, _BB_SUID_NEVER)
 #endif
 
 #if !defined(PROTOTYPES) && !defined(MAKE_USAGE)

diff --git a/include/busybox.h b/include/busybox.h
index ea58c0c2843a5b575f6acea0565b37fea60586b4..2e54ac55e7818c4270062657ce2ab3473c34e3e5 100644 (file)
--- a/include/busybox.h
+++ b/include/busybox.h
@@ -39,6 +39,7 @@
 
 #include <features.h>
 
+#include "libbb.h"
 
 enum Location {
        _BB_DIR_ROOT = 0,
@@ -48,10 +49,17 @@ enum Location {
        _BB_DIR_USR_SBIN
 };
 
+enum SUIDRoot {
+       _BB_SUID_NEVER = 0,
+       _BB_SUID_MAYBE,
+       _BB_SUID_ALWAYS
+};
+
 struct BB_applet {
        const   char*   name;
        int     (*main)(int argc, char** argv);
-       enum    Location        location;
+       enum    Location        location  : 4;
+       enum    SUIDRoot        need_suid : 4;
 };
 /* From busybox.c */
 extern const struct BB_applet applets[];
@@ -99,7 +107,7 @@ extern const struct BB_applet applets[];
 
 
 /* Pull in the utility routines from libbb */
-#include "libbb.h"
+// #include "libbb.h"
 
 /* Try to pull in PATH_MAX */
 #include <limits.h>

diff --git a/include/libbb.h b/include/libbb.h
index 40cff8b4b47dd6e0428bddce49da4fc136f7a13b..0b2411fcdcee200b698dc793af1d6fe5ff166507 100644 (file)
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -37,6 +37,8 @@
 
 #include <features.h>
 
+#include "config.h"
+
 #if (__GNU_LIBRARY__ < 5) && (!defined __dietlibc__)
 /* libc5 doesn't define socklen_t */
 typedef unsigned int socklen_t;

diff --git a/sysdeps/linux/config.in b/sysdeps/linux/config.in
index f1b064a405b6bd2433c8034ade5346d362450c26..e2ae0e8c4b90b725139f36bf1a158adc4d93e00a 100644 (file)
--- a/sysdeps/linux/config.in
+++ b/sysdeps/linux/config.in
@@ -16,6 +16,14 @@ bool 'Enable locale support (system needs locale for this to work)'  CONFIG_LOCAL
 bool 'Support for devfs'                                               CONFIG_FEATURE_DEVFS
 bool 'Support compress format (.Z) in unzip operations'                CONFIG_FEATURE_UNCOMPRESS 
 bool 'Clean up all memory before exiting (usually not needed)'         CONFIG_FEATURE_CLEAN_UP
+bool 'Support for SUID/SGID handling'                                          CONFIG_FEATURE_SUID
+if [ "$CONFIG_FEATURE_SUID" = "y" ]; then
+  bool '  Runtime configuration via /etc/busybox.conf'                 CONFIG_FEATURE_SUID_CONFIG
+fi
+bool 'Use busybox password and group functions'                                CONFIG_USE_BB_PWD_GRP
+if [ "$CONFIG_USE_BB_PWD_GRP" = "y" ]; then
+   bool '  Use busybox shadow password functions'                      CONFIG_USE_BB_SHADOW
+fi
 endmenu
 
 source archival/config.in
@@ -27,7 +35,7 @@ source init/config.in
 source miscutils/config.in
 source modutils/config.in
 source networking/config.in
-source pwd_grp/config.in
+source loginutils/config.in
 source procps/config.in
 source shell/config.in
 source shellutils/config.in