From cb448e0438a5dc26c7d991306b32b1b7d3935f16 Mon Sep 17 00:00:00 2001 From: Thomas Walker Lynch Date: Thu, 21 Feb 2019 22:55:46 +0100 Subject: [PATCH] checkpoint --- 3_doc/subu-mk-0.txt | 50 ++++++++ src/.deps/subu-mk-0.lib.Po | 12 +- src/dbprintf.aux.o | Bin 7184 -> 0 bytes src/dispatch.lib.o | Bin 9936 -> 0 bytes src/{dispatch.lib.c => dispatch_exec.lib.c} | 33 ++---- src/{dispatch.lib.h => dispatch_exec.lib.h} | 2 +- src/dispatch_f.lib.c | 79 +++++++++++++ src/dispatch_f.lib.h | 14 +++ src/dispatch_useradd.lib.o | Bin 10592 -> 0 bytes src/subu-mk-0 | Bin 42560 -> 0 bytes src/subu-mk-0.cli.o | Bin 8168 -> 0 bytes src/subu-mk-0.lib.c | 123 ++++++++++++++++---- src/subu-mk-0.lib.h | 3 +- src/subu-mk-0.lib.o | Bin 28304 -> 0 bytes src/try_rmdir | Bin 0 -> 18384 bytes src/try_rmdir.c | 8 ++ 16 files changed, 272 insertions(+), 52 deletions(-) create mode 100644 3_doc/subu-mk-0.txt delete mode 100644 src/dbprintf.aux.o delete mode 100644 src/dispatch.lib.o rename src/{dispatch.lib.c => dispatch_exec.lib.c} (68%) rename src/{dispatch.lib.h => dispatch_exec.lib.h} (64%) create mode 100644 src/dispatch_f.lib.c create mode 100644 src/dispatch_f.lib.h delete mode 100644 src/dispatch_useradd.lib.o delete mode 100755 src/subu-mk-0 delete mode 100644 src/subu-mk-0.cli.o delete mode 100644 src/subu-mk-0.lib.o create mode 100755 src/try_rmdir create mode 100644 src/try_rmdir.c diff --git a/3_doc/subu-mk-0.txt b/3_doc/subu-mk-0.txt new file mode 100644 index 0000000..a817a3a --- /dev/null +++ b/3_doc/subu-mk-0.txt @@ -0,0 +1,50 @@ + If we allowed the subu_home directory to be put anywhere, this script could be + used by masteru gain access to any directory on the system. Hence, we have + the following constraints: + + constraint 1) the subu_home directory must not already exist, not as a + directory or as any other type of object. + + constraint 2) masteru must have 'x' privledges to reach $(masteru_home)/subuland, and have + permissions to create the subu_home subdirectory. + + constraint 3) subu_home may only be placed under the directory $(masteru_home)/subuland. + + convention 4) only subu_home directories may be placed in $(masteru_home)/subuland. + + -> without constraint 1), exploit 1 + + Suppose that a wily masteru was able to move an inaccessible directory that he + or she wanted access to and place it under $(masteru_home)/subuland. + Typically such directories are not moveable to wiley users in the first place, + but suppose the wily masteru found such a directory. + + Alternatively suppose the wily masteru made a directory under $(masteru_home)/subuland + of his or her own, and placed an inaccessible file or subdirectory inside of it. + + Alternatively suppose that the wily masteru made $(masteru_home)/subuland a hard link + or a symlink to a directory that contained a subdirectory that masteru did not have + access to. + + The the wiley masteru could create a subu by the same name as the directory he desired + access to, and trick the foolish subu-mk-0 into giving him or her access. + + -> without constraint 2) exploit 2 + + Then the masteru could place subu directories in places he can not access. + The foolish subu-mk-0 program would then add 'x' acls to as to reach this place. + The masteru could then change identity to the subu, (i.e. enter the container), + and then reach that place he or she could not reach before. + + -> without constraint 3) exploit 3 + + There is still a wrinkle. If masteru looses x privlege to a place, subu might keep + it, and then exploit 2 would work despite the existence of constraint 2. It would + be unusual that masteru not have x privledges to masteru_home. Furthmore, we + degree that masteru has x privige to subuland. Hence, exploit 3 can be prevented + by following simple accounting rules that are already normal. + + -> without convention 4) exploit 4 + + Constraint 4 is a convention that masteru + diff --git a/src/.deps/subu-mk-0.lib.Po b/src/.deps/subu-mk-0.lib.Po index 2e62d51..5682566 100644 --- a/src/.deps/subu-mk-0.lib.Po +++ b/src/.deps/subu-mk-0.lib.Po @@ -33,10 +33,10 @@ subu-mk-0.lib.o: subu-mk-0.lib.c /usr/include/stdc-predef.h \ /usr/include/alloca.h /usr/include/bits/stdlib-bsearch.h \ /usr/include/bits/stdlib-float.h /usr/include/pwd.h \ /usr/include/string.h /usr/include/strings.h /usr/include/sys/stat.h \ - /usr/include/bits/stat.h /usr/include/bits/statx.h dispatch.lib.h \ - local_common.h ../config.h \ - /usr/lib/gcc/x86_64-redhat-linux/8/include/stdbool.h dbprintf.aux.h \ - dispatch_useradd.lib.h subu-mk-0.lib.h + /usr/include/bits/stat.h /usr/include/bits/statx.h \ + /usr/lib/gcc/x86_64-redhat-linux/8/include/stdbool.h dispatch.lib.h \ + local_common.h ../config.h dbprintf.aux.h dispatch_useradd.lib.h \ + subu-mk-0.lib.h /usr/include/stdc-predef.h: @@ -166,14 +166,14 @@ subu-mk-0.lib.o: subu-mk-0.lib.c /usr/include/stdc-predef.h \ /usr/include/bits/statx.h: +/usr/lib/gcc/x86_64-redhat-linux/8/include/stdbool.h: + dispatch.lib.h: local_common.h: ../config.h: -/usr/lib/gcc/x86_64-redhat-linux/8/include/stdbool.h: - dbprintf.aux.h: dispatch_useradd.lib.h: diff --git a/src/dbprintf.aux.o b/src/dbprintf.aux.o deleted file mode 100644 index 1dc581d9ede835b63479c86a7238894c71f22810..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7184 zcmbVQeQZy=p+K7f^{nE#wgX;V1jAvOYOF5V{4~&pGDmtqiC(VRa%+Wt(};rO`Xclx%XWA z<;G}IuWaA*``vTSJ@?#?cb^|wKeEB2X-pQ4tzk7JS;nrk9ANX2~EXKHF&d~s@OB;GeNH54Bh0V(z9HD^Uj*HCzzPfORf_;^d#+4v!_Y3aHU zKgH`S@$PrpNn6EI(72V_#0SHy`MU<8U$dr#RDnu9ZsDbipO3YiU$HfL*2ZX zD-OlmZ*fJTKlQvohhM-Lr*7o@oQY) z@8NoW%?}*&dwf{UYVZ|G4#dF`_uzXXdJ|fNe5M2CVBik?l4Uc>v*F8b_*^9CQkBF9(YSSj9n~0IN9|5MY3VlmPc} zuvvgX4jvLtBsDfhgRmZ3K$rPH9tvX}4166Ff&px3zzM^+Xwd}&=Kzq} zZ))NV5V`JcsT*N)&{<$AbO)#)pKQS#=Zug~)a0fG&A12}*20Qk2H#fJ+yzxI;D*p#(!n;%bePs8 zmLF-gOKtS>EBHpWZQk43_NcZ6P1pk2{%7>uAyHtv)_hMD+-zpr9PJ~aNYESV2+h%2 z8^dj|G3GOGXl3x;V1IBJM&Lz=LW8CaM>G(83)yfa8HCA*vtV!y7{d;aXx>mTh-Rn~ zm`y&0BYmLQ)B=jI8A%_uYY-Xq+Pnyy!G5dR_j3;+=>elaA1$@8U~(hie^nIHz04Kt z+9*=33t@nfgtj&+hw;(qa0Ev;(0*nxis8-mxvV^G&kVw_=V40cyWM$!X#*l4lR=v8 zQ%5w&TMti0^!O2tdD>48g7N}rVAuc|PcV$86yh=X`e6X~Ors#XavrL6i6o6}mm;2+ zSTwdxigE=tFqm&#BX!Do;x16FvCUHaR+V~Ciqa!!QDe3G1W2$opzt%6OZX#Asssr= zun#=!9YC7)9?YQz1p$1L728S{3+ZG&lSxkY_3FLLx-Bz1YB=4+La8#D>`N9(nPMet zGOkJ>nJzf?OeX2$sG}&=8v57Xpka(c$1#4MX|Ym|RI>{QOx*z!p+1olqvz`Ttb$|e;|>_-ibme%BzBTE zY?DnGI>yd)oh02c@=PByti7fsbS=}!iimQSX`@*GW|dV+b|GIfv$4#mVZmr>GT3I#%!E@@!SP}m zM2Jl1S-^;3LPfx0#C&*qrBt!a>=JIl2ZD(ZiK}*s9xXF35^I1K<6$UkNZ(h;ntIl7 z3`is;f>JkbWS8?EWUxFD)BNj@G+2LylFT#P_`vqqx}FuWzQmG5Pi)EJp1z(XJNW8Is?@WinB(!uQaE`t?O zo-nOkvAj=*pE!TBz8t_>tnx!(|UAU;q6*0ZIpdh;BXnD*`j+L$PQL|zv z?Mk|$7mZSuOG(>;y}fbWx|Oj`NN3mo%_VMqEc|H;wRT`D(6wiNy)!Uq+83&nF>;SW&1Pbz!|@#hs@ z_IE|$`w0I~;r~terwX4Z|1w@VFL?RK^0KI^^Ck29n!^8t@ShaENaOvx!fzxVE(^TK zevc7uR(QOAVTmgIZb7p}3jZ+Sr3!zV^am9Fn-tIe3O`6#`jc^PCO>mU)%&G}5^z{Yk!){QOq&^BnPVy-5AflHNZR{U-_gsUN8? zAKmiYmHcJO!-o}pcs1l@y~4jm{}hQd44fF!7Xm#&z5 z2)9Cw{R9Zh{j-R8ns#bs?A@v~T|gi1f`4Y9&kt(f3%06H^e_9rtvFV7dqB6|_{BfE z@Ru!J<#GJDZq@M*0;l=}ioJf{$+gv8td7grB|tsIwvb)IfOYQ;)_43E~Kh})7^A`qPX)pPDeWUL%U5u_$!0`Vm!?#7%9@m7DVqh4% aM(2k*FY5U5eX5>)JH`K9?ydHt+W!xz?;@-K diff --git a/src/dispatch.lib.o b/src/dispatch.lib.o deleted file mode 100644 index 548fd2555590c23aba4ba3ae0cd230960521d90c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 9936 zcmb_i3v8R!6~4b6Cr+F=Pnx8K#(h9jAWoB}X((+;(v~J$=z}IKRa@NO@t?%1V;lQ- z+H^cdD;S|G14e;OK+Di3ipGQ{4Ju%xTPqc5n^qWuifIxoN?%#Sm*nj$>4ass%Z^Taw+PUd$0aLp_5-+xiav zt)cIZ3%1#J@EXxK{e?aJ63Vol?4SPlU8IPW^uVDBA&Kcz2mg7&PTg_R-rDwR-(h=k z`ScmtaA#U2ODpM7DYca zFGoMz_%*;i-eT{4P`i|!5~QW9+pNBY>7sM>y(mL2m30}Dr^!`$7MhB^hu~L13lvle zfGA$<#|A~Wm!n5TuXNB?OS&uwnOFq>eCVrNl+*%U?0p!Rl4c;K@sjz*T$E8vlVW7@ z&UxFsuepSfGs3&P1YHr+St^55Eh{BcrI;?sG$`gO$pjR$N;1ugxmq&I6th|~U5Z&F znQp~&OQugTJ(Ag?m|n>YD`x$izeAk66?1LfN5G6LrcXwlR7}5QY{h)VXF+%NDdxJG z4q(2am`#=az#LG_X76WU?Vw_|R+hSjxJxnHD{ca@dlj>zz7AR*R?N=ECSZ;!W|s`- zNyXe)It@C{C?-^P9GDY|*)3x`shF_$QZR5@O`Fn^#_M2w{2(j5SNJQjF800)Q5Ac! zp$sP&#wAA?(YK(D#3}(NaxRckb_L7Us+m(Z?e77oSPr(FOJ#RUMA3(Gv~O;1UQL2Z zl_=Q*m6Y?%n~RX5=jZ04uPKL@x8&w-c~H{T*d1e$M@}xJq3}vI9vOyJSA&qT=ptMc zTnJm}#A?l?EsV>{omd?z7;SQ{ux@QK8WBc&>7xuleG$|1h`1eA>>Q+xHKiDu>%M_{ zY7!V!gE8bv!|xz8G#FcrWkNJ^dj#5#fj-FKuu#cserZPYT$W3Mc2@QlU_Q}h!K={* zPF>#RImx>~axVPCz;2O&O~UV1*Ub)VN1(kuD+8Y!D(EFISoUCCCj@6iR3xghw78B1c2(j2FH5D!;hS9LS*EPQT_KEW<5GXE&+VV*uQqB*svrQ@V&U_x1qgOpB4Hyc znj_r)RlcizSNZyDVMnb5A()_8AzyNtz{=a9q&z5fP2+0FS}8$NQ9)&f(O+wTxNiYy zwSt}UTEp%4`ILQZsi<(c>jDXX&Oa=lT4+V%@{?U1G_Gmn;FdJ@*J4k)8y@OyL`yXu zhb342bG^{TT8PQZogu8w87E;E`5-?vC1_?&UUP#G_0tCoXl;YGhPw|K!qsqJFTjlq zqtaYpgp!#T6xjK=p92-*;yegaCd4Iq5C8=W53M1Fm<*GkA#PxDf}kStkuh|Xx!baW zLrmVEC&*lO#fuxL{l8Y1W$g|!$$=PRCzBin#x$6XX@5?aNsdAZGM9^KrydOKx?%}| z>pgtB?}PoI;6}cHp8!B{M!#(0TgILzBQ9hwMOG3u}s8j4M**?$V1Xo z1jM4@*0GV1)_q-_q0Ww$loc5_?Uq1Y?v9 z!Eua;N$6kNjzp|cfMFlc#G}9h4g2w!What$Xe5!clukN27B^$6F>R+ZBX;Q8{(%hu zz}}jpz(6!XQd8-Wl}g3Hs4@XeoZ9x9Q3N4?NI02-^XF*L%qS2(Rf5a1xI`l zO2i_e#OP?+vV|3&jHVKCtdjzUF%*X`ictUNP}-cdLKbMH#}g?VPyQku-EW0#*&0iX z>_L*ughKGarl!5AsBMLkHkcWWnPX`wAI^-1!e-hMA+V`jh9=C^9xIiWZeeUN%b=37 ztdx}wfr7kDV9+uo435SEha9n3B0d(7KNua~L}+GaRrWv4$Fkn2S@I%g`(Uic4e!F@QMkh_eaJ2lSY zLfAXWy>#sWO>h(8#%iZG-+*#D)Z$9W*@9%c)Eb})5 z(&KLciC({V{cHyj!N^STkDOxM>$CZXsU=X0*74 zd^jk8%iB-^yle)BfLj#qyIWMuA}_CYGuqrj-l_`VH8U^-+;EZ83nDd+eDa4KuO>64 zg;+QXj>n`z@~yMrowML;X2Cbif@e23+Ol~E&wf$W7l4;K?fSGO@RmZGIJn4Ov~c8{ zvtSW6LV-hp%=+i}Xa=QOqHyDe8s&KevENv9`7Q-Z97l=mY<1vp$j{rPpK*!&qm@;XgJ(KWs$GRKykm`Ai2|2Gk%D8ZfBg|L;kGEmk|Gfh7&73*YFpK zSC7KEc=l7?Iw)TD`w8(q8qRsyq~R^Z@6hnQ6z8`!`B#X4 zM8l)x_qc}tfyVJ!4d?lBO2geGe^$eHQ#^mvaD4H^@>dP#b@i!+A5r3>i2QJW%g9c( zhTl&3d=1CPOe|MuxO^@Jyi3D<6vqY)-%56_*YNL>d`QDTmR^O3Y4~=+r!;(u?A)p0 zb;N&1!<&ddrr}SK{iij&h4|++d=2&MjE28O@%&!Hr%C=#8or7A^1j03^$gjmB0a_* zC4QcUR}XiihVT`&~l#&6<3i_`5WGKE?llhMyuk$25E+$^S^h zAEA7m(C`;X{uJTJlBo3XrY4Vnm%;Lm1IJS&e;3bdxDLOE~JLf95~uJM)(&R z&fkLy{7^%|e4_l76i>B=bDVP=IQqSZ>@INNXlIn{T&m$=!dGbclZ0QT;k@6iB^<>t zpZq=A=8(sD++-)L$qzvrmIE5j^XDN4&Sw>rf82qi-{lBGdDekD&wD2wILhO_2+MCY zoWFx_J8N&7W_dCuO~a-n+4}NfcfDw2zH^0 z`oZ}pR@_MTbUZ);7#@YFkYIXh0xtd{2+xPA9%m|L#mt~>?XyKtzNrMm>9h!@63C!< zTd*siZ37l{B33vv22V<(3DA_Z84jncN#@`gD^Jo)nej1rA9ZTO1FOaI;7bJYiNS*R zrC>Z^TS0g%Xo2T1cn(ua);K(~;ltJcsRY0d=8*HxX1j@ajRC58JQ&75S>e*@W`OE* zc$tE-g~q84Xe9YA0)JhR13Bt& zfcVDghF`+7ZeoCKdvi| zpYy*PFx@6V;$m8ak86z@E8?^0|BM`6p0@~R`oi8Zvd^ppA%Ij^N(*7x_`X)piPdG#KnjB zafR|LZDO;3u8)IEA^jI=p?=x?`w8izFK0PV`c4dK_RIJg!n9!)ACUeq3sTMfXZV*u z6v|&9pd_66s{x4h8OL~Z->BI~4;tOnh|2*(()ID|q@@@T_@7W{{~C~7?nm!Gx+$dJ O6;L{_;DJZy;9Nu diff --git a/src/dispatch.lib.c b/src/dispatch_exec.lib.c similarity index 68% rename from src/dispatch.lib.c rename to src/dispatch_exec.lib.c index d4b9c4a..166fa28 100644 --- a/src/dispatch.lib.c +++ b/src/dispatch_exec.lib.c @@ -1,9 +1,14 @@ /* -fork/exec/wait a command - -if the error values returned by the exec'd program -are less than 1 << 16, then + fork/execs/wait the command passed in argv[0]; + Returns -1 upon failure. + The wstatus returned from wait() might be either the error returned by exec + when it failed, or the return value from the command. An arbitary command is + passed in, so we don't know what its return values might be. Consquently, we + have no way of multiplexing a unique exec error code with the command return + value within wstatus. If the prorgrammer knows the return values of the + command passed in, and wants better behavior, he or she can spin a special + version of dispatch for that command. */ // without this #define execvpe is undefined @@ -16,29 +21,15 @@ are less than 1 << 16, then #include #include #include "local_common.h" -#include "dispatch.lib.h" - - +#include "dispatch_exec.lib.h" -/* - Execs the command passed in argv[0]; - Returns -1 upon failure. - - The wstatus returned from wait() might be either the error we returned when - exec failed, or the return value from the command. An arbitary command is - passed in, so we don't know what its return values might be. Consquently, we - have no way of multiplexing a unique exec error code with the command return - value within wstatus. If the prorgrammer knows the return values of the command - passed in, and wants better behavior, he or she can spin a special version of - dispatch for that command. -*/ -int dispatch(char **argv, char **envp){ +int dispatch_exec(char **argv, char **envp){ if( !argv || !argv[0] ){ fprintf(stderr, "argv[0] null. Null command passed into dispatch().\n"); return -1; } #ifdef DEBUG - dbprintf("dispatching:"); + dbprintf("dispatching exec:"); char **apt = argv; while( apt ){ dbprintf(" %s",*apt); diff --git a/src/dispatch.lib.h b/src/dispatch_exec.lib.h similarity index 64% rename from src/dispatch.lib.h rename to src/dispatch_exec.lib.h index 620c6f9..29e66f5 100644 --- a/src/dispatch.lib.h +++ b/src/dispatch_exec.lib.h @@ -2,7 +2,7 @@ #define DISPATCH_LIB_H #include "local_common.h" -int dispatch(char **argv, char **envp); +int dispatch_exec(char **argv, char **envp); #endif diff --git a/src/dispatch_f.lib.c b/src/dispatch_f.lib.c new file mode 100644 index 0000000..8baa18f --- /dev/null +++ b/src/dispatch_f.lib.c @@ -0,0 +1,79 @@ +/* + changes the uid, gid, and forks and calls the function + Returns -1 upon failure. + + The wstatus returned from wait() might be either the error returned by exec + when it failed, or the return value from the command. An arbitary command is + passed in, so we don't know what its return values might be. Consquently, we + have no way of multiplexing a unique exec error code with the command return + value within wstatus. If the prorgrammer knows the return values of the + command passed in, and wants better behavior, he or she can spin a special + version of dispatch for that command. +*/ + +// without this #define execvpe is undefined +#define _GNU_SOURCE + +#include +#include + +#include +#include +#include +#include +#include "local_common.h" +#include "dispatch_f.lib.h" + +int dispatch_f(char *fname, int (*f)()){ + char *perror_src = "displatch_f_as"; + #ifdef DEBUG + dbprintf("%s %s\n", perror_src, fname); + #endif + pid_t pid = fork(); + if( pid == -1 ){ + perror(perror_src); + fprintf(stderr, "%s %s\n", perror_src, fname); + return ERR_FORK; + } + if( pid == 0 ){ // we are the child + int ret = (*f)(); + return ret; + }else{ // we are the parent + int wstatus; + waitpid(pid, &wstatus, 0); + return wstatus; + } +} + +int dispatch_f_euid_egid(char *fname, int (*f)(), uid_t euid, gid_t egid){ + char *perror_src = "displatch_f_as"; + #ifdef DEBUG + dbprintf("%s %s %u %u\n", perror_src, fname, euid, egid); + #endif + pid_t pid = fork(); + if( pid == -1 ){ + perror(perror_src); + fprintf(stderr, "%s %s %u %u\n", perror_src, fname, euid, egid); + return ERR_FORK; + } + if( pid == 0 ){ // we are the child + if( seteuid(euid) == -1 ){ + perror(perror_src); + fprintf(stderr, "%s %s %u %u\n", perror_src, fname, euid, egid); + return ERR_SETEUID; + } + if( setegid(egid) == -1 ){ + perror(perror_src); + fprintf(stderr, "%s %s %u %u\n", perror_src, fname, euid, egid); + return ERR_SETEGID; + } + int ret = (*f)(); + return ret; + }else{ // we are the parent + int wstatus; + waitpid(pid, &wstatus, 0); + return wstatus; + } +} + + diff --git a/src/dispatch_f.lib.h b/src/dispatch_f.lib.h new file mode 100644 index 0000000..551d51a --- /dev/null +++ b/src/dispatch_f.lib.h @@ -0,0 +1,14 @@ +#ifndef DISPATCH_LIB_H +#define DISPATCH_LIB_H +#include "local_common.h" + +#define ERR_FORK -1; +#define ERR_SETEUID -2; +#define ERR_SETEGID -3; + +int dispatch_f(char *fname, int (*f)()); +int dispatch_f_euid_egid(char *fname, int (*f)(), uid_t euid, gid_t egid); + +#endif + + diff --git a/src/dispatch_useradd.lib.o b/src/dispatch_useradd.lib.o deleted file mode 100644 index a3b50a14cf64c8ff9ed4b4d5b7058a5a0eb7e454..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10592 zcmbuF4RBml6@c&C&D-5%(@mOf(}Xa?E700%v+0J?23kt`OH!&7n%JP0?Pm9FvUal@ z-g}$2I9f`Sp)E?0p8_f^KO&-n<1bo%s^Sl$BBD6>i;l`LjEIgi%2*Z8x%Zs6FSnav zMlWRVIp00^+;h*p@8>?)ziI2{kYNZehFB|V8dD*5ol}$hrPwbz!~!wAePH@ev4Ic0 z(el9qfCr{876S)Qd3y&ASAf3iRbEEp>DQtCW^6zBngjzMI$7Ox0tae2>st5~2Y>S< zR_T+|-!i1dlh~+i1AWZtQ{kzfd@YQo&w&%qOg}wv@S6kEPsI*?@7+7Ub>!(h zEBy@|o&zHJ0i&;lKubR-ZClRT2mu{V4jjG+ZJxlN^hq@&nl_-WOogbrwv)~0mn^l) zww-satW_vFu4iSPvFe0f2EnzwaoZ|qCv2-ykTUkMyoxnyTNBy5jsAt_?6VeCmsw-B zH@OFltwOd~vh&LKq{6}E|kg=rL309a;2=1N}p0Ll1jf) z`lT|Ulyy?srj+$k8Bxl{_Afx3yOgqd-lL$5D`h}NJ*kvIsd!4+5`RBTVXso&-nIgi zYnAejmO)UiQ_5wrC&1gZQZ8?K29z6=a^;+ZV0J_)?_Th8Xt_fv@9F#lD94quQ-<@P zQm$&e4f=duDVe5EgYu|ScFEXIDrGeG3OIO5t#>Ti*#_HEZp!G}67p(`#6AZGkr*~4 zaA#m#E$cx*`bkj8?58#HMG&R!KS7YTNwqH;4<;gTxkuz;%bn7AND?I?A01V)66js*$onDlyfvGLBbot5R0Q zuLfnFQi3}w9^6rJ+EHqt*5;Pj%REqXYhbrF&uzno7|d`7)N{eLFy@|xQE}l5-1zv_ zaIv-_Hs-Fv>xT=mjX{=lY)=?%3xl5KVTbwnV|2ywBH_}`g1n4CiNi?BaB(}v$3?NX zG=G@^)C*X~@V*YWfevFhG!@|Q2mYesjlQoAV<_bAuXR2IMt@gEMp|?ReUiVL?NP9O zEBs-D3%^6*zZpZd=KG*&NHxzG&q#L|mxp2-YTh4~Rzo!_81@VvI_@p#V!3gv(d;Yc zW5#^nYL021$yN#B+ca)AnqirYMTulQoajo-HQJ)Bkg3qQA|7802yVe7!Y#3(U4#=C z##hHLhz};=_SynQu<5ZvJ-S$66Xhl~E!x&7Weak`^tq1H{7sABmri_a_Ik>lU4kmFX{T)ZwccN{Z8Soui z@YVG&#U#WO2!(_Z4$Hp-M7fTL<;QMm zxTTr(>#4m_@rG@;#6Cla>xk%;U0DALwKpl=01jh6BgS<^tdM zKr^=El)#bdHo1o!)(vbN1LGDMsw8VhtHqMnT`aG~c3}>RMzsY%3AY+%IBA;m%)v;D z87;zNB-CIWG0%Z2bj0k!YKv(`GG=sM(u_w8vvI_XM(!}r1~D3$PMXaTV+S-mZYCnP zn(;ofG4ifs=6p1aOhaS%8nk=BY>mt}8?Od&XEF(<#)xSq3n|dUJ5!OnMA*&L**(p0?Ll1Yn;&>LGZ`|TFcE%H#N}=Gw`w;kW zY*@IwwBO?tJv%e$LGMB-JLZZicEJHgtA)&H*0n_j{7n^|N?Bwkvd(VXab>$>XY+ET zOu?~j$9A!Yn9REFo;>akdA9Rck2f4{E{;`s6Qv3q`s9xsx>U*SRt(ii2Yw48ldC$g z+e+1mGEQKum=^_V0@WS2OC?U)Emp-QeyqFb`CkI3uh}-Z5-#NUyT`QoX6P)w?|1 zm+noUZ!Nh3axjqf6z^WS)ast_s%874F&j2gF$Zea$&FtGx1jEoE3ED@tNXIvz>F~N z3}$)d3XH7)$MgmrgSE=F_n}GBxFX#g|TsF76I;r*?-ZNmo$t|fy z=G8z;x%JfEobs}xCEH)|Y8h^9`Cb88t^_U!wFI@B4=x1!E8Oa6RV^Ieu4EL_H(n2X z-|+?B!Z5rCAw!6js)`)9tXw46mr(bNS0?P9iHb8hZdctNIY=p6&P%Dsb>Mz`$%YLV zT1#MgmcHrQ2zg?GTbpss6~frtYIHS6V@KdNy#^S+cFV`zxsp>>Il>F~yc75ZRP zqGLm%bzLI1KAr)2i)FA%)M!iOOOR9%O82+hO!s>{8T2mMw5p_yf z@B?{fV_3-VH!~q-OI#j{bvJ#dE~b5AGHA&o*cu zBO9#vYbkR4>a+<5f+D}OK+SwUaru2Cz)#Sn&EF$%XObyMYF}cFet0a@m*Wo<_CG{h znhy!g@zWp{^)^?tzlZEMsb=5Ld1Sv;<5jZXuJL}-vl{;o=>?5P$iJiUFH#;ppz)W; z{*cCx6F;u;mnqJNG`@v&K5B4&_7ZQ*H#&Uzke?|Ij8sA9q+^g|FlmACF&iAj!G=8fZRy?h7!s2Hde~A45UgHfE z&tEjYiu8YLJi$8o<9seAKMOSe6|z59Fj>FNEWXoK9AVcAJdMTbW104VJ z3*T=ojmysPvnasve!hqrmIpZc`4aIJ8viWujT%3j;u+9*JMp&%cm2-H`G>}LD=eC^GZY?ou~Nm`H2xXl{Q*v* zY#9!49G5>;76P2#6|sXuocHY$(u)vNv+xgSoZkbkn}r|N_>X8m+%yZnL*obNdi(e+ z{CM{W_!np4oGZ)^zY}4K_$9oB8g*Tfaw@2xc{SY zB9dh>!a7CA%fJSG{;&Ph&=-B;IX_sI&_IwlCCg7~GS3F_tldw4j8GC~1h{_*4gc|2W0X=Uil1blZKv>doIeTbldlWSl>`)aU2`V%`n7gpaI9S8`)9rW zZW}Z}=~k8h%l)`M2`w!9Mj#xg{y~PaZu>kjElqy^5zPV5pYgLG)XU#^o&4eVCGO98 z#d!3w(f8{VKc9>6a>8#qdVhT9(NYXVh;6uFPc?Nh{u_TiSn9FjfG4pmp$Sd)M3ZI zb?%&*b7t4{b=RCG>rMUSJ@0}w(h$1UxR^GV;v|jv*PZ;sqwnoM@2snrp0w@iQ@`s! zaQDgYk+%vbb;x=V@I<|&O~g6lgj*(__4aOpqaKfgI&PF4(nh1t8G}B34Eo|R=-p$` zE61QeItG3B81%1Qi{gE-~Z-5@dnSZPXVKo0VjY0q781zfVpohkw4~#+IJ_h}> zW6&p$L4SA*`VC{y|9lL3-5B)cpcjh@@p3#4NC*=L+5nR->fE7m^Z6dWb)jZIX5@Fv};;dQzu0_Qe8+| zy8F|jGu252olPAb-OUu-3^C+E5iu%3k|MRat$RzCXx-A=o=!<3Gq*Igr+X;UkxKQ5 zWO8d?x+#s6mL>uBrjwmb?OkG^wWqheE8Qwuds8WK-twgl=O$09shgbz>oVYJHD^G> z=FaXetsw~?cwPT|E|?M1otF>Oe;z~)4^k7qK6mTw2oHYoT}``H;y&>MjrUJzcUa;} zzu6J?6OAMIUd7NDsQ` zWiI+57rop?A9B$#+B3(~E;{c4=6J?MpJ0d|ryqOZV-I}nfsZ}#|E&jpRdnL}iJfoS ziQU$*SwbXs4W+%upGoX|+NS}{fIcH9><=M z_;bX)#D^sQJ>r~d96KoS?-1t{4!iGPVW zrx3?BO8oQ0IdwR;QsSQ>&Z*Y1xWsQJ&MCyPT8UpzoKuHmF^OMAoKvu4QHl2w=M>_Y zkoe`qi-^DVdl05=BF-tpv6m%&32{ypjy)ss3yE`zaBN88%ZPJoaO|MO8;EmCaO{A@ z=Mm>r;MiV?pGKThfMYu(ehP8k`j7Ph-+A2I?<96_w~u`XK3|#GT~;@AI2wzK#O{T) z;2i!Pm=3WyE_saY#rCcH`O?8>FG~#mB(d|=w^lYTeQHQdguqkZ-dn}wse{F6*YQ7@ zDa1Q_$^TeuP0=Jis0gw5(94)OBo^|TE;&RJyNGjygyS!_?tQE^%gpi)OaAMAA(L6VLuWU7XPn)Ee^TS^kcNom~CsFIkfq{ORyjaQc(hdQd!)w2ZRt~1CrzZv*t7{X3%d6)uA6!%&Uk)g7!%+Inq8W>-R~F4!UcIqs zMq_nP(TqE*cR;3S#@*F>W%||X12X+a^+B0FQayw;vFC>BmzfU!9^U>E{FT_#SZybu zJDS+Ds5{wgC8D=#p0sAk+nDqj^UZ8{P58ajvt4l2a@%Jj}M;ejml{`sbn>dNIZp?|QXpS37{ge>w8B%Km3$FCYBna37Vvlo;GKokgqx zmKc02u^W|pYU$uppmTH#pAY)-!S|OB{^E$397pD^3XoCC=b+}ulT&1gH&Ny8=GgMV zpAApcigpbZ-7thvU%z8P_4J|}9srowvo$n)r_BG+^1;`Z4nB#phS!6zbdUeU!!78& zi3ex(^>6C$XzEG~+DCo@^{s@~$elh(@f0UC8nQPVBjjV;=lR zI0A+zLHEwz951@zQ?huS`L4?Jn#?~#=8=-A)RNfwSi$gvY@yxKFA2|4SnWZzZF=LS z-@#Tmhn4#Tyt;hwT~^^Y@3RUECc#U?ZvtLE`1>RCrM}@#=sJ>6a1-_Jd0;LyCH6c@ zLlaN!VzLJL%LngIC<>$4W=VN;t)gs1g6d$X?xHZk;aAzHkHL^#1u%biLv;DzZx2(^ zk!x@n+~o)3?uOFkgRc+n5`f{MS5V<2N2RwCgZD7l4gVuZx~dQL&trvtk=Qv@n%MdB zTZtKuw+@z8C-z)j?Hw*dtu)_*^R}`nbE+|T4~=deT<-TixybLQp{&;(umm9Mb+4?@ zJs(k_(@~A(gRjWuy4;&z#PY!hC_5Ymmt6G2h@+Yn;7RP>!zNGcejrAPJuM=-bkCx~ zsCLa${_2)_{qyJ@|L|{qlNEb#UhkH*r^1(764A%+2b(`M{4CfG#n5=m_AID|(G3U_ zzax8V10u-r;jd9mu46~|@vw3!-A$LG9oN#l!ACdJ*r#^2AwdZ_UF8Lj_SrrF8K3>) z$bl)c(%+Lk_PyaLD4w2~fb@-%%?%*2`!+fN@$0$iLL8nhyU)XD1u=Z9v^RAWVXS^b z{iXGn)h91~?4h%ebr=PSBR9oh;O_9}A@?wxEQX_KkT?FJwP?~JHqcKF?@-Fnlfk#J z7ktADr4jE9-}W9@zf?3yJake<-$AfL-!kgsd|`M|H+iZxDI+WLot4VS9>n$+t9nk!BAfeV9`W?Y(0b zL{&YG)S;M%IlUMz*5bXNRY2fgM`$Rtk2g`qr0`mkz!&d<=FS zc}FT8{xNOb-6@9ehR(sqFapxOxSy}8doHmjU0sM^HXj+g8>r@Q6-PLAYTnU4aG z{Tlss*HHiBhdrPaP1=DgZ-6~0s%~iKW1iu^1c$l_>_L%~c|glpJAdaJ_+JmQf5Rp4 zj8*sD#Nc;0A0B*qJ?0+|or^40|LMx~ho-Uq)B~mm+0pBslf1H@Cw7;hC2t4M;eE3F z;Y(N)S=sM3YqrLm&(vSMbnu7u7cCup7p*(^VSVHBJ=0pI2(c!yXC~9t%V+$QbN1nL z-hrxbf9Ok3s{3bMPkFO`chTT4>yMYdh})Sban_IfUuSu$4LM5Pb1pgGgCR`ia{xFW z1OD;xu?If(!2kOm@Zh%!_tD?iv^g~|HmxtliMSBwwxyb{Xz$t_+mebk^`>II{asx| zTYI}ZV@@P3u23hF^hXno@)qe-;A4u!(eA zdta=lw|jGMQ)jHRzb_rzBnykVl;#%N+}z#Yl{N}Gy1S*B{XMbHroMElw?BzrtWvS* z?KP>Im@0Heti3BXE0u1Z)zj41x21)$tfgd}GOce)j_AA?Nk%_@`fBRhoH~`BX>00> zb#=$ux}hJxkENQ^-M!m1W3%yBx~(al(I;8yCjE5N5=(7u@1yanjb3fF*4mw75oyJC zsSZbLSYsrxiVsraIN|qMe8f$89PWAQ0(%r@$*zfhV(w=U^Z;;BS0R37Tr*(7@sRmq-#UqU4l>r^1fp6t9LSt}vgu+#c7Ld-1? zv-=jC#4f-!*4*9Msoc=l2M6LO)NXXw zKGeIpZTbvU)F5!&Jo$U?^cmVT4iu9sS%t0$IJ#1)mOc#q*7jbEQk2`@nd$<74rV;o z-6~-j98f4mGAk)fP4{k7@qoWG!@at|Q)9?r12%2OPrm4q7-q&x!c*m&zZTN$saL;o z{P>+n3x9t6_?t)Q-5*%_~S@lMC!-!C4Ow_)CbOR== zA0Rcq&3Uf6PWnxIFG)L zhY84uNOVc0Vp&mWi@igfGhzNIr&nXfruaILZiJl&NvMxRcY4o@yzKGb9f_VB;bRI9 z+VeS_6)59W5>`Z_8<0!*t2m#5{K5bL$lvH)91bk`wC_{?J=TS{1a<~}U-K8h{(3x) zEC9=kIA8wN@#8;0DjFiuJ>G^$#Vx-2NbE*`ePsGhYf&Wb-B1vj4oZEb0vrtydy)FJ zmGTo&pBmk~;}=C9 zmGX-0v*Qvnd)UnU#_T<+(D@TJzsdjg?~iwrWc%VW$K3OWEroOH!=qN`tEU$s-dAMo zOIJsQPThN~Nb+gAh{q*lo_^yRF!MqDh9D2K=V~Yzm$;#C)VQ&Gqs$e;>|rzIV|iEB zC#LzaL@IIP&$l%GlYr8%)%+hz%)avc0_W)VU82*AblR%Z0iE8c)7y3WWu1Ogr%&qi zd7Zwd(|2_mz;Dky%5-{?PUq-!iB2!lX{$~Lbb6ysZ`bLUbxNJ*oqO)Q*mUgpo)Mc{ zgB_!>(`xJH*45RX5u1J?9*7cnK$rBHXUrIb_q4hZymMyAJ+)C5fJQv8zS?toQ(flo zC5rU8VZX@dF?l8(!P7HWm^_o3{-?{bHa9otRmQciRN8aOc`Gg!rz}SKW~?aLQ)CY> zqTM_s?h)j%8^$Cmvtr*nIeoRT9tZeU1 zHFdOa?xNgi{*3DO7_ZZh{dvlN+@I*@#*Zc);dAhqdqbHXDI`$bgWH%8-$={9>( zrz3bUUbuyYho$xWSGF(v=YM9rj4>AEIQ&D#QvP_M;D76QLE9NWnskKE|3Dto_EjIz z2Ta?K*KNl&4s{!5saWgK?S4>VBQJ{oS7;{1&wWfhNFVJ`{I}p1uK0J9#3h?tPZ>o( z@$bTvM)40-Dt@`1GA94@NrwNx1jYZ_D7+;75|;aAp6$67F|BYRE}w!2Myt3tfehdD zD*nFi>jYy10RK8%F2rf^f{1SizXzqkO8{4R#qCJ!2XIlKu=i(Rzx^t7c;%n<+4igq z92Eh7@cYo=*xnT^vAF{KmV|c;I-dV%Ig1H+?C&%22Dv~K@C2Tfm^BSaf#1S9BkZuA zM$Np(!C>89`6J|be?<6>D#9U~_X9{CMN&vO{3I?%19kRiP-bKab59TcFC-#T#6spc zzXfbZu4K-c5{X9Ufj2N$A{CMMm~)myVv)H-=1F9Fyx=QC%4MCL{Si@-vO z#3QZL7MDmOGLcBVL{>&PmkTsVWNoC4$fC0Qz_2kAB-@hGuOVrRq=_V?)jg5Zh%A*z zI#NiPWuaG)Y>j+{$ob!T;_ZM$-&4a%t;p92jo!XG&D_M zqqJ=(5@60I`(L5papCXtsANxPhH;LLobW{~W-x zagGy(GmwOAT3vV+z~T?lF`cRj%q@8rR8PR7Nd6G=-1!1HN`Y!_BM&Z z5C@0v)_b>?<3|tSaio9Ng2p~yv029oYWX{ym7Yf5uRLoiJ*y}pCiLt4*N`WwX5qrq zUgIg8cmx1X`$vW1He~w+2fH5f2T^+tdG~P!vgLsD9xXou89p_teQIF(ZJ!!|J~aS+ zY5@AYasXOt0Qy`5(06+!JFOgmzB{U92e$W6uNr_s!nPcM{yIAbV;l}Z|LMUdB*NhU z^v`krlw1x6p#MyXL>&%5|6GYwI2?ffvm_F8H~{_gBr@IM0QAq7NUg&G=wBd_x$OWTnFa=x>n7T8H-g7nPj_hK&vfpnpl}IY`^ek!*E10R88WTaILh!vW~OplCIa>m3e2{|b9CXgeJaK>wvoyE07#;H~{^ZN^|aYH~{^ZIp-od=x_k~lLa$? z9CA1S{TroiLk_#Lf0KPB6zBnH1uI#20SBP}6Oj-HV8EUYEMPOEkPSw=!t5QSa#V#l z00Z`Vf*gPWn+}z{*8z~cB_cxBz+hyLk}h z53I*IF4Z*vP18xc26#Wtk{8HVAiKf80)Gi->EYryR0we`7{~vUMs@=!^E5iXXiVkO zV)ozi??VMoJ8D(bg1|Gd#8W7KT?}7~=b5GM#W$giI56`k32b$*8h~Ck0KIBldetcP zs^REW!_lXPqgM?_|4*UR_vy+8l)5D4rPkKQ}@0oJsm^ zRZ^DsRSfIPD9igQhP8zMl6vl%K-jYVy~MtHg3NIc?tEXHDB%yN^*fUZ2kZ}Vh0RBi z1PS|BL&_g7zJ~A)!Yhj9pyv$0I$F;1?Q5YS8gLNa5Fb8;j6kUH31kQ-gq%R(_&3NU z;F2d`HERDD$OYWxADrYZ>VZ_iX1pl4oTSN$6j}zvu9kQ5(9a=YpH_G=m_nb14*N_6 z^P$n6FJTq3oH~0RXfk9urw1vZLY6Z}h9niToHHe&LY6aEA}VA#XGuhbEN7lXRLFAX zOGJe%XMsdi$Z{4+M1?FTE)f;7oO+3G)ILj=Q8J6$f%IzBnu{^wN%J*HcH!6$Z|H>9A=LTKj#bu z!OFh{Um-)5^NC1Ug{%v}5U`mMVb`KvMeIMME&&o&A*-LD3Ryb53>qayesk`O~yVbuhZLiM;5 zo+$Z3ACNvt((SFF*M{rtZRm(j36SvVvNeSx&7Ca~+Y!u}6XFPoI*))id}fG4r_{L% z%EG3nVN_d9Rk5~&TRpg}lag;3;-@E~B@Sx#hO(HDV4 zomwJiM{WaB;e4Mm@i0x8=*(bFeV8W1oCtHyb?Ad?=OmO9Su9mgcMdXVS(v@6)~SL$ zkqe4BZJO)QL6Mcwmw?2b8_BkQ{7m>i;jAOFK_Y9N=ZRb@kv3;Mk;}_jgRLUMv406b z+0O2SgilTa$zD=&;am=vMo>Al#Gdg>!EZUqOdOdgc;yyg?Mp)>n z8vhT&X9@qF+%wr34?}MPem&08d<@Qfl9?SWY-NbfJ&KGU z;4J-XDp^&?Krqo^kHg(HQ5pve27a*+7eKJwv&Qi~IVDaSvKw`F8M0edw)bk#)0#dN z^zEA77ZPQ=G`$w|FKPOAC~bsPxo4HP55=BS5tqv6g9kZ|kDJkXfWbd-U_1OWeh1L` zu&=TYQ~2g$4qo4_2e(gn8Xe~!bQ#_ZR7z&gY&eJ;?0L|G^!}e~rZv#9~xAN+k+ z=z59YyS+p{Y#o@&fH4IAuj4H19v^4PvU9Nsq&hm23YA$_s~_*JBx#1Z&F!DrxuUjTmW@7KUL@AN}nc<>m{1f#Eu>_B0s{Nmr_o!Qd--xs9Iagi3rZhP|{)vw& zu2HtuOPc9c6!(lS?pn4Pnmj1VKG4~BA^UxIwl#3W_Rsmz^47o(0HSP#w(mZ0R-$;> zUFtH;ezD8^I+ZP}m2}ZF)rzB92g0V=-;mAz0)+kvr)u^$3+_R)pA4SKI90R%Ds(7k zc)Xu&_Tq9?YYzKw8sp|pQAC7coy}%{UK_Usm1|T1v8>yb|DhJ&A_n$t4@{XF%Cddh z#dadhLVc_);%YI49f(8YXPSW>=xoK1(?Ral&R_@WllkZ%8?~A6wKNCgOs8w5(t|D! z?p8{rXAimP#JbxdkkL9u9AOf5qSET+x8$uJx zT=Y_mMBVAidNiH)#j_RN@$t{vc%Wo`Upz~cZP8tpG2~LinTa74*XH$T6e{F%E^mW! zp6pjRZwdMlNj?TKR!nLDH-n0LGGeHZr28f5Jx6_sbyZ&m-+D+JHt9iF1<+o6ExxGHaC+8O|# z#91P$YoUr~2n#9IrJSC!kUc==LOsuMr+dTGYQcSyl$iPjBs_~sCr#zb4bS3jk*R+R zUY@0vRlN`?Pwzq~Y6ZYE_yUk;0q_ikec|d?U>(okUwEU{A3zV!;Fp2i0~VgauK;-m z0MFo8z0s-X0^k|$Di{0V9l!VmFum|IAI5XxC;!);uVY&JA71$3f{oX;VB^&bHZ}Cr zzDhQhWe4nAk($LA!v0$1`fHaEG(=%gRFqP8&{hPD;5@3NOJgK z7O0ksdkz;?0%~E!;lfHlEvz_PSP7_wm4X^ri-9XbEGsU8T$Kyh`+x+e1GF!PRlyTI z6Ubvsu!GGVSF+jAUgoP1Wb&y+|s%vEH2u0$%r?9TRC z5{ZSmifqr5$n-E*k?r{ssSTgcoCOk@%V8kwg%XK}x#(%fC6Wkp71^$r$jUHRk?jVF ztPQsjSyc9OFl-ES71>@=%HJv4!dykR^^#1OtH`!qk_qGfDePsT6q2psuMp8oGGVSF z+j>bRJj|RGHiym5FxPACRYeZGds8?{WSy-2-Y{2@?e*oQ$k`X>Dzd$yauSdOVXh+E zmr8T)4Kq~OmpOw-4u-jkY$pp?_MtFWk!`&s6Xq(iy~&;i1$s%w309sDVuVXF_9r4m zKZa1i=0j(|W<~)!810g+OzO+XD^g1`MW7d{C7B5TCGQ!Aw?sHxhbb70aPcG{8{6SJ zOu@~PB3)dtTftn138{4$*{=qGV;$xSBo5bMLRAw;a;Pe#)?pm3!-OU&`i1CTg)>#( zy_Rr|go_y_JX7U5LHpp-spB~UR^isS80R?o^f7e`X+H)20?v}A9y}|a zQb^jBxG8kvR8KN>vLg2Z|4W=Dd{>?4H2H(t&w;;!b9`_@9AbD{lvg3HgH>hAV5VoG zoYH!4U0yz3^U$aYJRkJo+K7w_&nizXrkp?1H-{GFAAme~93TIDS00tWa%CSe+3!rz z*%Lm{**%c1{G=}G8X#PEkgE81x;#*-rw)aB?bAhNtLD53oD*=;uxrTT9l%vSE>?DF z9xh6pmf;cQdtIf-68J~F?h-s0o>gCf7kGxdqgCdX67gFT=YYo3ddC|*!Q2yy#KbM2 z@w6`R7EUxFz5pR!Z~@6LK8-vbq8|jv5S{-6`z;Q`r~GyLk6)YTdc4=Q9`Dub@neK; zhU+h&(k5IJ_A^BL)Ec?}9vJDry=*>tMi197A}e6ufvbto68=LX^pg-e8mzPb3|!^bq50aK1!pLyWV* z1rnKyhbSNmB@z!Y&IaQWNrV_@gY^06-sN-yiaW=TZJ`CE<5aVocRnb2JxhWJS zvQ93X?hP@{2G^IrfSi3H#@XP8%2$yb2r0POVRrKdBYo0pck-L*7uZ8=+B@e^Sf* z1+p4dHr7eA<>?#1xuSAFbN;pD!qYlmPoR$pe}yXY45iDfeglW`#E;vBReuX2PwNrS z_z7mV9=5EBCXh!&74B*Balqm4s-9xcv`9(F7paOAd&UK$<%ou5!WWqrnjbnVw6p~A zk|+Vc$FsD=1HhUrmX^#yxCvB?Q0Qz3qxY70e34LyVq~$yTF257#wDi+jOfvt--hL+ zP;22yP=@iAl|M^rh!_pDf;x(_W}&y1K>vbD^v2mPW6!B1Y20K~u%yOwPNk{F$(2h> zSi5+|9SxN&cy$61)lg_BT`Fi|~cEzm? zV4i>s!3^~88bNEiBGLxyEL31(4hh~xc`o;_DKGYn=KidY{mP40){6n-#h~({o$o~_ z--`uqFNTa43r*98P18o)j!=FrqFDS^>{5lS_d=HkmwQH}ID(BtSP)YxdH$Fz2 zxIA1w(uWl}BqlSKf&Q#J*b6P?;s1bJb%jv;(h}vakh_kGRG2M|JzjU= zh;cp~tj1N8o-Y1KPt&WJL8?7SujYHY)NO_7=^@XWat?zs<76V`E;na-IOeQ5O4-Rz zKnK6jbEv_hYuAR>g)Wu@w#pK9CAx%(Ii*7AgxRRt>`I+|Vs@NNl66M$u}pR0Lk`%O z)H+$$Q#uxFA#*U+a0kh0b2*f%b4aoqOv@qV4Y&W2exa-BYIVn5bJgkvrhP-EeGBu4 zX*hqFM%+E6$n=!|{(eEP$e!V@hKz%ztKeSe>L`_lOrbHupKPGq@FyGSg#Sw#D8D&E z`OWb^F>pCZ5eIV`Lfxs#Lbz?Hb}D!Kf7FISv*dc2_nm+L?t}nThe?H3{E~Mm&+l+M z_TV6b|MK+*cn|z6{JG04eCi=NXZFnAR103Ip+5gGYwoP}uI7$@yi`E4YGl@?_H^G! z%B=LZo>VSfh?Y(2t@1TZ{ab6AQLb3Pw@9RCws)OP3@@_ByA5jEXb<3)RI7reE`XSe z9@vZT{CSOo#kG9YWLQv*eoHFZHc9aslnjrRuOo(nLu z^@@AgpGNIprqiH-M)ny+`44u%Q9E32)nt$32MRbJIIZC<(Fsh1gEp+#!lg-_|DG)|%>zm-(l;- zM$7l5z$I3ZZ2W#J8t|;e@K{KK0zk2RmsrsqAfFvbgI9GFyP|}hX8ez=QgBS%X<-kH z73jAnQqY2iaUfS9nGbBgRY5iDt%|Qe&6Yq-0ArKVk4QEv@JY#F1@58Jf3E9m>e zHINV7CNp2m&-@ZIec`=Uoo_>W8C3aV9@=$@GJn4{ZYhNOX@sg3&4af4E#ITQ$g8pn zurU;vV1<2KpGVgHGR{zj@n#g9F-c}nj6lDvvlX~WWt?M$p8$2U!p^qB^MJJlYSva- zzFvR>mz1z}mes$`Dq!CIpWJUb0iW}b6@J#TdII}1C1gudMP_Wua$u{p6<2IOsIDiZHr ztBMI{Hc2a3s$#FR7VWyvnj**l&JwoV#fWW>V!(dR3e82QxMaUI9=T3{P3*ghapKFk zNshOiD*;}L(2sGBo>bCW1Kf9Mjp`bwf|2((-cGEDZ{sq=M1ly@o9{v>It`%8FY{PY z-{msD%(EaS=cCD`E0UY~Ta&4-7Ln}kXi0Xrw&I;-g7m(oft1YXYwPY!^95wtZ#gkv zehw@# zsXm&(VaZQV;dO1D{EiepN_B;3?a3I_+~14IQAdAgm)M-4>ThAu8jf#-2gU%r9H6HOy{XO0EqIq=Q~onZ($t2v zM*Vx5TJSY1*wEbFf{%2OBp*@QyNql2IlI`ob!WO?2{7tA3-Io}bbnWB;pS9Vs<*uv zXj5-<+d}mfz1Ymnv6(BB@v2g?HR-uIvy*AjJ&@{c?daZ;MAdP+42MNv0!tG9!l$}q ztG2hKk}XZ?CW&pr`vv-YREsihf=9Ns%T>CyH+S_nXX=$4NH=ZjNM#xiPLRDx@wVdi zd0pLXaDIo3g|e|>#w_{X!Org9p0-qfpWM`vgO@3b{z)cVQUj<1yxWdA$9hvR$+m08=kJnz z)WOE&n5{*!8CEnW5t&lG1F06FUXUq`q@eK-48Yq%yL(#@1gRYTkh1M9%3qzRom81_ zLxR55-isG;pqr>(CCh`~6mt`q(FAM(W4x>(3P8L{(o>34_Q?FM0YeaI*#x>J@YWA} z@J~0j?(uX3btK`l#&Ma-bkO%hEDmEmUuebu-JTt3=Ef2K(8tXf^r9N&US+Q@R-&+6wtn zSy^wTLasn$E?pY(h&2YhJws|V;6Y9D3;c!f{)})Aa6n^s>(nDw8t`v2q}2vA8o{MA zM@nCgSw;iCs7W7XIDQ`2T#sfHG#b$8rh>-(2K#Q7(SYuf z8pm+aXeF&0t)x|%lD?BEX_W!pC9N7!5~hwL>f;q@VN5@w6_WPv9i^H9o;Tq4FlFT7 z5tkb98BJ0?Hkf$@1sIh?{`C}1sL?5Uf&o93A+0v*-pG`@I$x2(Pt)W%8QGNv{QC@P zgHiW(M%@OTnVaCTVVb&wwB5ERVR1e+I>a`_`@V(L6fT_j(AZ6qjlEMW@=oj+HX3k={fGa{0`*K%NjBoWJdl{-J5K& z^0WTW`d59{HWbs1ZLwPC7)rO6v1Cr6F_3=;&LgYJP&VouOBPaS&{T%Z5(*94o*}Oy zSt-q4m8-7THn==?hw)hcSc6wGd82qNlb0>S15mV(O6;bVU#hjY0G?>eCzV_U3R&^q_*l$GWXP#S8MQ=EXmwJ|53Xa(aWVn zf^_YzTEbN8Kjl2}Ev;>fzG>141~w%WOUGT!fQ-LBjM8`cexO+Xp_(MW9|SpJ3rzLz zH|{sC&Sd24&Sc~lpl~x$c}mwLfIoli6;t*b+|(M!mso}f`YEf{c9 zhIEkuJ2go?Eg0gDWgf5#0zM$#>~?cy0dZk zPjwbZ8Ic^obm;mF<4OZwp-EoU(!jT5*>cnX@hAfBarrvEqHe!YYWg~QuK~>yHQLmG zrZ_w!T$?HTx=h(4y0lp?G7B;JwmqT=RocjyPOEjw9Zx*W1J0*3Zk}xp=v$6?%2nLi zYrW?GQ=R@s^RKkBJZ^}u7UN-NKZb9|82pCM%o7ZsnFA>z8;8X}!Z^=r?@k zc53t*IXj^An1>66jeXVZ!VHwXn$?VkztQ+NbvmR|)AN6%@mF;E$0r!b;$CljgrE;U zK|ek!-6vihmF~~HC*G~hC#=l-;dAK$VcsL3OAm_C-oNg{6gL)(yICdd!&}}rj!G{O zL!;6|*w{Xro`?>TYA!4KHkBYmiN23?x152aP$7SBzpR2z_ znD_PP(o03`?9ud$7jK<28of-2_-OQUadcFAg?M>XI{pe{l*1<`;5DS9>8~1vn+r4( z$Do@TS#GvZoR~|{m`_X^gB}}$K6wP4LB}ut?Rb91LK3j~#=H;S~eh_po-tr#H)Bkl%UztaLLeux=(f=8AkEp<3XU73$?oi@& z36Jb=#c&YI9m>;l0_YwwvfnNMeYARgat!+VG3b1>A5G77W6<}2&h|3zC1>4ud{NWQ zd$ko6FDL*on*ImDkH7U1-#965STpHp{A#gn+=y{{RO%TyPG6xtqxkI|Ngo+E_@|qA zmB)zjdjja=&@N(PT-s;Js}M6KT_djK9MFr=?q*!uI&UKGhA}ZR4y+zS&*m}cSAiad zo)_bBSE=~JY{?%U@m}DY$Ix>!>E4m?_P`kY-x!1b^ceJB%tFTHSg4Q}$Kd}rNe_>B zC*JSI;OAfM(+~M^^<>aTEBDGV>{%$=Wu&3YK`-_e2|E_g$>eJ-N7LUye!fj#^P@O< za4m!V$83Hx&qjO;-)MUFjX}R(>oMalrS(5L2LH2T(DyA^u1#Du z{X8c1gfrj&n5CsY97F#&>F4l>zigd4hX3b)PJ8nEbA#4nX4j|ca?cw>&xSGRJ!8;s z9E1LO(2Kq0nel6!^yM-5xiB=&J97T>;28XWNByX;sE9aQYS>TTMFlJTufY@p$OoR7!(F$%XajFHSDLU{Nv&OQ|Dc9rn;HT6aPH z`Ag5u&4I6bxsL?f+meeDT0>&dg(7+0@)ZsB%abdXELpv{G1*w(uzWGK%I!AIef`o; za&u8UF27HcJPlv|IRpDzxK%8l#=TRyG`S-wmy}G&&1}YrY99$U$>efjBNlcF<yMeM{{`)3uX6!FI&#JxSyq~<_xj`$Gws3V*4xo?dDPC! zTw1cFLyfzpbc)t;9QL%Ujb-Q`%cUigjpv`MyLVqlD%F#l&8<$k6u1_frgCYbrf*v(wmc$D_o}qbK-j#L>g^FV z_#SksroLh6OzwwO81_uo$ZsFd#ICX$V)!<7o2Y5o)&+ek#YR+_gH4>=@Rx%mk%vIn zL;(%;bfiU%Y_*y+b_t3aMjqsK%TZ91YSXc%tp&0MQxa-eD+vQbaZ_hILhj~n=)$E& z7NC@&aYPL_S|X$=yJTf*n$q|qqD}p2gv^?j)TVy!I_1~5GiZBPE26s2+O(+`TgxXe(H=OXOR!QcXFTV&m_$0Df#LBFv*tl==n6476sHh`z zKi2pKNO5=1*k9|5%N)KBf(PIA!h@?$th&u{b@+^qM+=u{kWc^zrLCX1^8(5FV;tP5?_@*6dy zDL=pdH)#0=&1cq+hD`ZdG3D{}HNt;fSEf&Nbun3t1H%zjN&d=5e)|uC%`G3(@-Z#H zH_zdkY}CtdRlDWQeDolen0TxyP^q~Zd4qo*fLq>t7tGcJ2TztcN51_BkV|>vfAf4H zVj$w+8@b(w@xP(n3&1UJ*30g$Rva4)qfYbGiErk~XV%rGDS<;&?mF_zA3|OPryeeu z^|xq^63XW{xJkLs3QtuTd9zN3w^qo*@F^_Ye+>O7GT3)a`DQ&Yrsbc}_M84?kvHjUpt|KV>w~q5pZ2*ABWKcIBGWBzo_CLG`TX`Gulx8l z5b84an{|m7wY*L;BC!ml0LCZk%;z)mYxDR``6l%N&_i8vn)S=s4D2}g(m3~#U!O|I z8(nU`TjnV2EjJNxJ}=+rm`|g~)%u5`SM@kBYVvt!k0HNN51cB~P+CF0e8U*>f6}4^ zp5V>Jb>z!mpyl)ZAMa5@FPo05br^Y*%0GE?={I0(i-HyNoc>wffh*l{$V-1??Q1#+~N=i8tP5`YyoCaqsO4d?~NP43q6~52oSsdHrE%6dpXsk9Qp_v&wIIgoBXS1V_IB8rcaWZ~0^X!>=7Bln4 ziNn&6wkmBBDSVefMm4dH3Eo^XQ>thZ`(Qak11sRYS}wmFcU=V_FR3@P-$x7O83yM@1ZzxWiM8@@#`i=_|OlZ^(obeScP=R7A@ELYCx{x zwVoYN`9eWNzD8X&hJ02?;|4=p0fYQl`5XP&f(s@ZX)nI#`ZCaBR6=83QJC){6#AYTz1hw7CdfxM0Bh zJC6alWWe#Z2LW6*;6&&Uczeu%lWo%gK54+itseok>js?ZnT3|m7%97VFM!@U_^8JF!_8O+Lc^dC2w_7D zP8jCZimLjq^g+f1db&n?5+??7ZVg}oZY^)G+XA@H;T5DX5A z-A_Y9L+_1o7`mRA!ek0zPC=>O6_kIcUXVPRR*Ab5He2ZL4bZl% z|At%PTOXmoTJcJ`6whUo@%dCLeqnSZF)|!2Iq8h;MswLhy}qDad&yqS;;GfCv7yp5FL!Aa@kl4b1u8-v@;jW;MuKBK!gsL-BKmxCJs*?I|Kym z05u6LvPB@_04^_=6Hcj=%a&a-s|J9M0ENZBO*K`gV58sH)#djGEWa-><6jrBjslqW zZws{f{rB#1-N3_sE3g5MWXnoSo=7Asa|x%AR*7ORohZ)Dl^s_HEkIO-3T1oA(HiAU zvE)YZ&@N{$Itdp{j5=zaFJ)aPvFL)$T+W^^Yg6={w9Af4wi%(76fQHGFhrYb2U?D+OooyaRKVO#!q^smxwj-_eobNOV3DJzi*1K5xTngh<7TnHO9TkYGGh%scUXv9y?RD&@Eilmk^Q#mgml z)Q%iDuq(0!hHdNr9W(vd@R@8~Jf*A)?N)zFFmxRrQsnQ^8gwf-5pJIeuiTxeSyx~J zkLo|~csZ7Rb#Lr&NYkFjdR+T(C#X|=xEa(bKBe!^t6F?Y-?{7X`W{z@*SEMje9I~h z37@%7t!nd`yHy>&a}|e#PmlKMCSUE6w4%|c;CvSa?`55yap04q8+d)w6Z(-g_|0qZ zt9Bm!aMzYPZC$({RWrvC_0A5jDcq{D7jNG&WdLL>IK#O1nCBTm9!HOP{Tc-r+r6uj zXA1dN_dg_`-7HCwxeGXG6FL*VA73-aE((IyYiv5M_XS@f{Hov&Ql7sR{JY4{ZNVQQ{4c@(mGm2^=J}c-y*9xUt?m&# zzFK10D)LcEcD+b{a*@xmhkI>Um*N9!9PlVc%5?GWzq{!KbYS~ zxJ&R+(jO2!zKUas3jT|PcL=_T{P6g3+)KpI3;j;Qmjypa_!+^!NcbheUo~ke-p@EL zzexW|=r0p~UGQfp&%Y3lkoR5;VbM{|{{KL6TRc3Tw!BBT3!c=~1`m(>=TE31;^EN` z?*sP<{t?n27X0ss9~C_Bt9v~>#{CrabHc-8+;JL*V}jpD{7K?@eBg%%UCs%f&yS*q z_nwcJJpM7CQ^I7rQcNg28Z*`{Jnzb{tm6d z?-YE5@WD0sV}jpCnCGAKBwAe*`Z#u2o-kE4f99_Vp7a0g8vK_9&-a6u*WkY^c+Q{K zqs;%0LZ9>e`x^Ye1<(2W(J>VE&wQ)k@h*j>cMU!wc+Q`n1NLvcD0NimbN+lUV13T# zoX~G0N4&S-eiCHoQ1cy@{dk(RD0#WgIsdoFQ0hmB$H$Fx&{V9voQJnK6@%X@Or2rL zbuPFnreAGi$#Pl6N<{>yITRZL=;Z7eDgk4c+{z+RX(w5kPh<;oMX=VgolKUTr4`Na z%C`dBCA%;WKeZUI#;gtnzu`FS74lFqe4BLOjXYK;x=svU45N??{JdcNI2m{;xAPA5 z{+(C2PslMvZ)5mXr=YI43;;lmwykQ@SXEjnNc+vujC1}@?Qwme&+YK>mN5dnKDmwK zbB%f^uUI>Pr{IHy*PlVP^~`uT2>6aO#st+j=|P$$j6aIwdBN+O&+`X?<6KBpSA2he zK@5!4Jr3IS;`h=6J4z2D#z#@cPXH%<0;M*fQz#!0jRNX(U2r{XcSQ8LAPH1 zQ}jOr-;XeV+*@S+mw}T$fl_~>2^~b>DN^@i&{i-0KQJH^wnx|k9~u8S;G|EWR5y)# z1c9eW-5bzWFMfm;h&Mh?sf_=1;G|CsH$w667mWg{uYhj7_)`?0*D3bD9X>MtcYs5m zoF|C7*rfO>Zp@y-@wvVQZT0N&Ul}Y>Q&qp&j_aR63(Hj{5N5nD|DFb^`+Kq%X{uSW zm;K`Yv&-LrP;dM)b;b{uG~4sIVm>l9`o2!_-=c(3AAbvx_IR%oTLduhZz}CSagAzU Tvj6C_p8X|C@OI5qOVa*-W+27E diff --git a/src/subu-mk-0.lib.c b/src/subu-mk-0.lib.c index caf5535..6e0d541 100644 --- a/src/subu-mk-0.lib.c +++ b/src/subu-mk-0.lib.c @@ -1,48 +1,68 @@ /* Makes a new subu user. - According to the man page, we are not alloed to free the memory allocated by getpwid(). + According to the man page, we are not allowed to free the memory allocated by getpwid(). + masteru is the user who ran this script. subu is the user being created. -setfacl -m d:u:masteru:rwX,u:masteru:rwX subuname + subu-mk-0 is a setuid root script. + + see also 3_doc/subu-mk-0.txt */ + // without this #define we get the warning: implicit declaration of function ‘seteuid’/‘setegid’ #define _GNU_SOURCE + #include #include - #include +#include #include #include #include #include #include +#include #include "dispatch.lib.h" #include "dispatch_useradd.lib.h" +#include "dispatch_f.lib.h" #include "subu-mk-0.lib.h" typedef unsigned int uint; +/* + Fedora 29's sss_cache is checking the inherited uid instead of the effective + uid, so setuid root scripts will fail when calling sss_cache. Fedora 29's + 'useradd' calls sss_cache. + +*/ +#define BUG_SSS_CACHE_RUID 1 + int subu_mk_0(char *subuname){ + char *perror_src = "subu_mk_0"; + //-------------------------------------------------------------------------------- #ifdef DEBUG - dbprintf("Checking we are running from a user and are setuid root.\n"); + dbprintf("Checking that we are running from a user and are setuid root.\n"); #endif - uid_t uid = getuid(); - uid_t euid = geteuid(); - gid_t gid = getgid(); - gid_t egid = getegid(); + uid_t master_uid = getuid(); + gid_t master_gid = getgid(); + uid_t set_euid = geteuid(); + gid_t set_egid = getegid(); #ifdef DEBUG - dbprintf("uid %u, gid %u, euid %u egid %u\n", uid, gid, euid, egid); + dbprintf("master_uid %u, master_gid %u, set_euid %u set_egid %u\n", master_uid, master_gid, set_euid, set_egid); #endif - if( uid == 0 || euid != 0 ){ + if( master_uid == 0 || set_euid != 0 ){ fprintf(stderr, "this program must be run setuid root from a user account\n"); return ERR_SETUID_ROOT; } //-------------------------------------------------------------------------------- + // recover the masteru user name from /etc/passwd + + // char *subuname was passed in as an argument size_t subuname_len; char *masteru_name; size_t masteru_name_len; @@ -90,20 +110,31 @@ int subu_mk_0(char *subuname){ #endif //-------------------------------------------------------------------------------- - // Just because masteru_home is referenced in /etc/passwd does not mean it exists. + // Just because masteru_home is referenced in /etc/passwd does not mean it exists, + // and does not mean that masteru owns it or has 'x' privileges. // We also require that the subuland sub directory exists. { #ifdef DEBUG dbprintf("checking that masteru_home and subuland exist\n"); #endif struct stat st; - if( stat(masteru_home, &st) == -1) { - fprintf(stderr, "Strange, masteru home does not exist, \"%s\".", masteru_home); + int stat_ret; + + stat_ret = stat(masteru_home, &st); + if( stat_ret == -1 ){ + fprintf(stderr, "masteru home directory does not exist, \"%s\".", masteru_home); + free(subuland); + return ERR_NOT_EXIST_MASTERU_HOME; + }else if( !S_ISDIR(st.st_mode) ) { + fprintf(stderr, "strange masteru home directory is not a directory, \"%s\".", masteru_home); free(subuland); return ERR_NOT_EXIST_MASTERU_HOME; + }else if( ){ } - if( stat(subuland, &st) == -1) { - fprintf(stderr, "$masteru_home/subuland/ does not exist"); + + stat(subuland, &st); + if( !S_ISDIR(st.st_mode) ) { + fprintf(stderr, "$masteru_home/subuland/ directory does not exist"); free(subuland); return ERR_NOT_EXIST_SUBULAND; } @@ -120,7 +151,7 @@ int subu_mk_0(char *subuname){ subuhome_len = subuland_len + subuname_len; subuhome = (char *)malloc(subuhome_len + 1); if( !subuhome ){ - perror("subu_mk_0"); + perror(perror_src); free(subuland); return ERR_MALLOC; } @@ -128,7 +159,7 @@ int subu_mk_0(char *subuname){ strcpy (subuhome + subuland_len, subuname); } #ifdef DEBUG - dbprintf("subuhome %s\n", subuhome); + dbprintf("subuhome: \"%s\"\n", subuhome); #endif /*-------------------------------------------------------------------------------- @@ -141,20 +172,42 @@ int subu_mk_0(char *subuname){ -d, --home-dir HOME_DIR The new user will be created using HOME_DIR as the value for the user's login directory. ... The directory HOME_DIR does not have to exist but will not be created if it is missing. + + Actually Fedora 29's 'useradd' is making the directory even when -d is specified. + Adding the -M option supresses it. */ + uid_t subuuid; gid_t subugid; + bool subuhome_already_exists = false; { #ifdef DEBUG - dbprintf("making subu\n"); + dbprintf("making subu\n"); #endif + + #if BUG_SSS_CACHE_RUID + if( setuid(0) == -1 ){ + perror(perror_src); + return ERR_BUG_SSS; + } + #endif + struct stat st; + if( stat(subuhome, &st) != -1 ){ + if( !S_ISDIR(st.st_mode) ) { + subuhome_already_exists = true; + }else{ + fprintf(stderr, "Home directory would clobber non-directory object already at %s\n", subuhome); + return ERR_MK_SUBUHOME; + }} + char *command = "/usr/sbin/useradd"; - char *argv[5]; + char *argv[6]; argv[0] = command; argv[1] = subuname; argv[2] = "-d"; argv[3] = subuhome; - argv[4] = (char *) NULL; + argv[4] = -M + argv[5] = (char *) NULL; char *envp[1]; envp[0] = (char *) NULL; struct dispatch_useradd_ret_t ret; @@ -167,8 +220,32 @@ int subu_mk_0(char *subuname){ } subuuid = ret.pw_record->pw_uid; subugid = ret.pw_record->pw_gid; + bool err_mk_subuhome = false; + if( !subuhome_already_exists && stat(subuhome, &st) != -1 ){ + if( S_ISDIR(st.st_mode) ){ + #if !BUG_USERADD_ALWAYS_MKHOME + err_mk_subuhome = true; + fprintf(stderr, "useradd -d unexpectedly created the subuhome, will delete that now\n"); + #endif + if( rmdir(subuhome) == -1 ){ + err_mk_subuhome = true; + fprintf(stderr, "could not delete the subuhome created by useradd, bailing\n"); + return ERR_MK_SUBUHOME; + } + }else{ + err_mk_subuhome = true; + fprintf(stderr, "useradd, or a parallel running process, has created a non-directory object at subuhome\n"); + return ERR_MK_SUBUHOME; + }} + + if( err_mk_subuhome ) + fprintf(stderr, "encountered some difficulties when attempging to make subu, you better have a look\n"); + #ifdef DEBUG - dbprintf("subu made without errors\n", command, subuname, subuhome); + if( err_mk_subuhome ) + dbprintf("useradd finished"); + else + dbprintf("useradd finished with no errors\n"); #endif } @@ -213,14 +290,14 @@ int subu_mk_0(char *subuname){ #endif int ret = mkdir(subuhome, 0x0700); if( ret == -1 ){ - perror("subu_mk_0"); + perror(perror_src); free(subuland); free(subuhome); return ERR_MK_SUBUHOME; } ret = chown(subuhome, subuuid, subugid); if( ret == -1 ){ - perror("subu_mk_0"); + perror(perror_src); free(subuland); free(subuhome); return ERR_MK_SUBUHOME; diff --git a/src/subu-mk-0.lib.h b/src/subu-mk-0.lib.h index a93701f..018289c 100644 --- a/src/subu-mk-0.lib.h +++ b/src/subu-mk-0.lib.h @@ -11,7 +11,8 @@ #define ERR_FAILED_USERADD 8 #define ERR_SETFACL 9 #define ERR_MALLOC 10 -#define ERR_MK_SUBUHOME 11 +#define ERR_BUG_SSS 11 +#define ERR_MK_SUBUHOME 12 int subu_mk_0(char *subuname); diff --git a/src/subu-mk-0.lib.o b/src/subu-mk-0.lib.o deleted file mode 100644 index 045b335738a5b493499c198b60733535a947197d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 28304 zcmb__34B|{wf9`fSC)4t&YqAci34Hr79fPI&WZwtI2&X|ktNv{u_dF$c34cBg+_$X zB&=N?38Co+g}jEgK-kmA+P?SkLHk$=ePt;Wc%eY)D_wx{&Y3yqYBZMme($|+epq+T zf6kn3&dl5^%?;NqZdu~8EWyPRb48Y7REXBjY`s}lo5g4`N~~@=?$5kC|C0F^&tJVX z^W_uRG=J4f|JOcz6>9GzDL*n#%FF!BQ*?bsUKeHFT9o-T^XvJUKReg-YhvdUH$WW673z!=KqX^{cPGl9WI5q<^>YXP#Y}c@}UV<1LxLwq!n% z{Q({YFlosVxjW=*$-L(X+IhTc$8k6KvUPUt)T$l#L)E{hzl_>nYsvg}Y33QwC4r@T zipD=4ZUB~t8j|U@bXPFu&v>Qy_Dqi#n4f7b6{NK#^O>$#ulx7h+zjRc{}VU{Qug*g ze^s^P2C1GJKQkJ?35_Jhzx~NlW#Vob7r*r?SZ#sZUXBI^2c0_|q6(&DU6?%qq9i-F zWd5dGrPuv??wQn8RVYU7}SJk?7zK3S^<51?fkvWV;w`W?4T+b{jDiWGsP({DcvX;!@|H7e`%v*A} zE_0bGS~B-zUulSBS%fURr58rH9~Z@_OXFPwyt{A4DD1u;B9(%%~dg-1;<<%6LXNzjXGt)CMIz=3vQON($%tYUsGa#1K(+@!@0=6QR z`p0|_i1YW%t_7nPJiDm&b7XH{kXckqgOMB9Y<_5QgevC z8C1>2>^7JbPR!JVcIMQdBpXNO#3@x1cAy;KzZnDI-#rH@nPE-GAAyupDd^u5c{TIu z`uQ8?Z=8SW{J_R1A3hh^aQ4Zd`gd1ARXhSgRvk|K-}b5ri*SJ6W??XqK#i17Mkr%W z9IBci9zGdb2g|crUQ0$Xe~H<@R`s7%_?2nX4 zGiAnoU_)2shxGE1vVuxp{~MastfKKqsmb@jBh*fDzA*D=GJ>q~XI{)}&Ies!0!Ulf z83}EU#yWg`5nnJ7@g>r+7?SOYc(*U;OD7`u@p!5pEy04ol=K$O!?ZRGM^?iS7|5|PsdU$per7iW~O_5-N9rk zl1K+)!S0A}YP3F5?^8-o^+jX8hDa*Z&=X81`@+~4w*$#IX-aZZPS=?}gjjwul?cW< zB4_xfBz>L1q%Ritb;dz{IGTurQt`wVVhnM-Qk}t+BTuqom}vJ2`y&0(BpSbx<&xDT zH6B3~DaCe%w4`3fvzEO>k-V9O8+_rM9zt|Pdm~btuiqC8g(AtMFBNBd+0+4MOJPt zipE6^gsU}7RsO!7_Gm1c>;wbQ+`8_~b&XS}Bv1AAMN^&eG{gsODiv+%Xjd51lJ&z5 zANKVGQ=O$k4;YW>DlijUF(w=b)dv1`2W2LqD47}U@q}bTpGpO?2f8;08f8rm?3AR_ z30q4=LpqsgNVY{|P>Cdh;jpL+iz#V2TY&Pl2cumPNI&F;F$qU<{Q+@O0t%pE5p~_7 zdov^(cz=ekvA^-0#>P`iMcoSV$00)C3MYhD-WQh3y7n>0lOJ z7fUj_T)6fLcaa^9rG(2XDXGByjnNCBMb-C?p5@f{Y4!aY&rM^pJU5Tc_Pu5FrB2^l z$7budkHNa_RT}O+Dcf@2xNQBOCSu*={SrQ1%I0FM%U(szL#}q}%Z6Oeb^Fzks9$a%2BTJdU0lXoWUb5e21nZ?+Fi0LIL$*WqeBPZ2XE zF;x+>B+;md*^-!{h&hsIRz$NT{EC<_iB?4{ki;5AEE=&A?A)Y?CBxPN(WwZ(w7N$T zOC^y~#Q9}Mz=eKATsZVBAhs&vqN=4pY*WNCZvdoiSH$wFI1sxOv9{tNVB4#R^&_u< zmfIAuVf0QQ4k}`!H0LfwTw3xX^f{`CK&h53W%5+H~zovm(#s^tAP^VR@w5lARTM5aYqrt*hS z_sDTq$aNA?_1)Qe`IvIdhsryE{XO`r7RA3}Ddl6wASC;gkC%L^K0)F#xf&~)yjx&G zNQW!Vl%q++S(5Oomg!|UL#h>VP8m*}VT#Z*twPVV3d%G!m-bfHd(VeSB0E(!RzyGo z5ocFqpso~E&Z)Ws2&JfUZspBDj8c7?E6{{-ikM%4CioPwumodJtBA!?^i)NhUxC@x zsECV(`~rv>ifFBV1BhlttRG$n@%JlYgCy1{VxuHF6>-@}^q^lri;}dENVt4vcvY5{HY6E6Q7-tZ>OZnDArY)40aIrV);Aztp|j zYI00-_Z}Y*B1b_s4l;D8AX;+pf1m&(uv{r{B8LHg0%R2kI0ok(*_<1ooanCxrZ1EX z7Z~rzZUg*eh+d9t@D$x$?(&|T9RrjAT-aL$eHm=!Dp79DNuF^SZ0oi%oVhp>ioU&U zo22g=sDWE!VI7=|3kDa*9`yAd)1Iuk-O&8csu_a>hPr!?4P@J~yBq8>-O0%u*VWLz z!gY-n28Jezx&oK7_#T6IY2zm_Yi}zyz7A7z!px zQnu$Nh%^W08C}=p2*t?a7f_(JU}R5H_l+t=atOyqobJC=VzSvH#&cF3gJy?#S|@(4 z6K?>KBXVw~krEh_BpACKjK!rx-`CKFQ2q{CskkX#shDzR=ZApbNH}bGjups%58?V? zpt6_qDZ?dgc}|Ft_49nJrt!Y2Jl?`8=NN;M=9x^{X584+^Eqp)<*VC4TH_+}sLc>Hx@Bzvpumx_p@djy9#qDL;ufW7)(svKhISXbo~ZmAItUbe(4cL>)WjTm~St3vDHsHhq?!Kn|~Qt8x(*;&=DIhvs2 zUur~Ig}cJhSA3_dI!k;{C+^mXdtKFznu^#+VGXgSRMwQaE5}w2v4$2`kA(2min6k~ z06_$)3O7qdBZRwhX4$N=bIX?2!1pUvzyu-03)00W3%q!1EO%vDnc}kmD5=o8&43=I zXDPr&IrB!(9t{tn1WC~fD$iS&4N%hN$n%A+hz&Z zsC^6I-e(jyz~-4F6xzm|1RYjb#}?RV(3-NfWtWtpu(7sisv!;Ia9HV%?2fzt@Cr>iAexq5>Gtz>a09K9>4 z(YQ<_db-oMm8<{aKpR-xr;fM{h8#s&aJx$lbDiF;T>a94F1?KeJ>dwvbg+&~i9hFZ zK2ggZVXa(U?LcdCx+nr{yO!YV9L83zvLSBKd)ENF$%7%mJR%VSu|nLAA5add3xKU$ z{jp>~z5rL*c@TSWfC)AL_*ngg^q>O}S2c?c4v;ea0?O_u`oXL%TxA`g__lmb-j+|K z;I!J870A_B94KFUSr{D7qI=wm*Ag2ByS#y2zT0tm!^2c9qHoioBWWvmVRQcAnAOVF z{mw9~yekUPYx%#jJtz`~MztKD;@M}vf zkT_gri!5;|tL4!LNU>)>sXqXxQGzXa4|m+7{BVxI~}eI$KaF zdiM@^;C8_?d05FOW5%%+yoX^QuJc%$eN5}jb~6@=#-H%8T?gXqk9x3M|Eu7M2T58VEhiWRuCs0o0;RRfJaKKcMZ80^R0f2G?o)Wdf z`+)|@>Z1gVrRBm$*IK%sLRa4NZy=ht`-3zJeB)=zpHKW>r|X}Izm-zP7>*&;bwy+8{)QP1 z#6P%mLuyM;Bv+_98YNHM)PvOe5Jn)G3a08i(IVLas*pci1vHroha>F(L&V_3R63Lj zq@vxCWKSdnAPi?3PV=O~PzP5#BB^*!DiDe%B1#bTShBQbvEt6wpi?xix`ForIQG*8 zf>gJjJ`zaQfl1+L5{~zTIscqI$~EymNZ=l(KXzF-B4Is`fPi4sfKxW#nXUxC~B@3$JZlCoK;!8Yh!3xX$q-EWU z_TM(pZkKz!Yi%1^pazb4+_Sa;_d&b(V$UPnp@!Ic?7t47wG!HfeCJr6y>?}vUA!95 z?H;S$w#K2p$}ujK#sLAhd%0cn%Xc6loWD4JRcu>T~DdearP5Ian`j+|3aPdK9B`A=7vh}#wgqL zefGSIR{ItRH@IGF}!p%pxg;3b^zjwiwanDbz1Fwr64uNUP-!(g2Hgp|;83D*g^ zRX4i1o@rDZS!DyY53m(F1SaIxmQ(O$+Kviv=+xX#VK%@7mCL4De{rSuIVQ@a;xQ1k+{yJ2GEFY6ux@s34#iM& zAkZ%t1V|xR7cg4_AXClc1S*p5tA!V4Mkt+tb*?Mj4f&5&PCpA}q+@W;7=~tu3$FPx zYsGmB7tZueg_(Kke>pAjZjsJWz}329g|Paot+D0B-o0>#jL%%-kO7K(4wzqAeXVP8 zg=fh(+&2{Mu~%I0*rX2a<$4`?XF^qZ{wc z^AtDUrROPbK@T!Un;YMZ%2V9xMChOvw>n0h2OspUi{x>O%0avcxCQ(qo~O9gq0B)o zZc#G`L%{8vtIKV6tD~Da;1HmOYH{Xgy0L)cFVtqK1t1@OdI9{*0yzGll~2xs0{GGb z_=*Df+5-5d0ysWG<+CSV0N+{w&lJGFQ2@WW0RF84_#FlCy9?k)3*dux>+D9xkCwQV z;nIgY8eMTq;SG-NFo9IJ5_F5jYa6X$biZbZR9Dhz`9PlzL}vO75c8h~Y)XRHJJ>jOE z(+&Pc>PZ`5#H6FL4@6u@^8&h}r3#z47I>lv0227ZTv#SFr6yiS5Y zw*NxH*-n(y8S&GKaS%uvU{Ka|MxUpkLRxlXTM$~z3&I<`Mh4kaZO|S{TlAm@M|^s7>7}0_a2R3kK0okuE*g- z0lW+ign}2Hzm{+_ZVd+hXW1JLuoyVUGekIE^mtxLIK~bA+Dd+H)A)72uG8>|z|V2p zUjY9;;V5>J#{UDtS+9B-5#G$!v8qVrHp zJF5uCZn`}qHC&Iw>4dXicn^|GP@9XxHTE_Qy0_ zm)~0ezqWwh8wh8A-zR@>*5v4V|3Slby@w0nKhfmldbpYV`e%)Q3SgXvztC`9{_6$s z4+!VDvHU-1{8KdfpKG`-zlJt%jzcreqj7|rc~wienOA3MxGw*!0yx2PANNvh@WM|- zXb&Ery`SvC=MXH6A0`~{!LTs?np@GhS7Nc?k60yrs{B;^tP3H&FJL*tDPHGj{AkY) z370>X0L}c}#JAYs{|EyGrA1vF{_l~Tl?Kl1TF}71Npji^d_Vb{Fz{!Hf55=k5q_P4 z^E!Nsfsdx(9WwAoiT+0e$5#chJghE`zf)n* zs`9whF&`!Z6vo>q4kHY_lkiCfZc`liK9l9}k%d_X|9d3IZ{S}Ny~e=PLoLopMDhQl!QVo1T-46|lgXYc0}qfr;|zQj<>#peejf2pH}D;#ccFp*fb45E z@KJwi!1*Egb_3`2{T>6KMDagn;QWo((+2() z@&DYw<-ZLDzP(}Kt9bqz_{${cF9v=E#m7VO=J-5Kbd7<#Ne<5g=64Zaoxwki;x@~` zs|eTc&vE^qMD{E*_=gkSYv5G!NY)=Kr`OM(A3FrHK*1Lz|@1cBQ zIo-rxYT!}AdHrKKw-7$Y;J=&j@dnQ8%w!G6JS?Zdsn>9fGwi7ic)jIhW#dv4*1@-nZ5n`0FGmpy4RTOL=&ihNGO52#*;!?-xl8 zM>+hQga23p7LG%P&rra`qGcyoRG3e(w0WfnP=ZuV^^Rc@O@u zyshCV=aaDJ!Zq5}A3hWv*}e$2psM0lTpmlA!YfqRMG zN>{d%->taAz&V}|XgH1w|88=}=aD+Bd9NyJ%JhTN;jX_;;3%44i+L zDZ)TPVS6s4IFHtFl=EH51>Z$$IGU0m{#gco1>voP;|1sSarncsR>Sr2lK7!aD@2#mxUURD(@iv^#;!G0Q3-! z>aqF>{9)Ol;TW>Z$-Z3%zM1engtMJ1$o@kbj(PPi3WxGT4M#iqWt|rdoZr~_+`xH% zucj}BQ7_8h41ZY0XgJD$h2k*Hz~3PJJi<8+J`@P0Rm1hXU9aI7pT{W<0Rw-S@UVvK zc^lVolv7TACJo#}c)y10dArNNId5+xoX3UVV>+VY7y|yC@j(s8xIIVX_=w*1z&i;4 zp@Bb7_yY$19N~`;&VEfsW1zgC;gnJme@(;D{;3j$`&k2TApAcJoPW=-=!hBXok#qY z27WQ&lQmq%lkj;Oj`r}mf>j!h{C5$5Si_P3YQnEF@ZE&pWZ-uaey@S^bM#L%9QD3Q z{I6&@>Yav;L-|m{amevEY%E`BIP%XY{vlPeS>_?~H!4z0)Ntg#mH4M?IPzae{LLDU z{Pz+61_OVN@GA`bUkU%Vf%Cg!M>QPv^0*w=aMXJ(&7+qz9OJeX8=<_b;RxM8{9hXQ zErbuRmff6r`U&BuX*kO7RBU3NhNJvHVI!1P8jkjFmMA>OXgKnJMf^V{9Oo&f{F@Y? z*A1M1?|^3g8C}d^_>qSpdJ+z`nDEa>*tju}?SxZMLoV06M@%n>fwJG5UGc^ z6zbpw2zW0F4v3jI;f0 zM>90!>yQ6>Etb#K#rfoZd|d@CTz8nDGLh!ZUueDHHj{T5G~|o_CyP~&sXleZ_~W|5 z_TyP;ESuoZl!^ElxpbHiW`T`~3V2P~id>q-A6qtPJ6;R5|X zJRKUKtf2b{MGe+<5E}B?KZES&aYp;`R@SutKETi>_7keI%*BZT#c#|*wx6%~Jd&^f zwe$d1C#7URxF27irv6zDRr?V?z!?qPkKxy#f>_Sl5A-qW?`KB3vi}Uf1eJX8Yt0kC zVZh7%Ij;G1OW8A&hP|{fjRX>>ve_S(33Khjo_lBEXZCwZMGYQ*l$o!8C)xiFcciNs GzyAbKGB!>C diff --git a/src/try_rmdir b/src/try_rmdir new file mode 100755 index 0000000000000000000000000000000000000000..2c4c607ca3282a992c376b49c67a3d5be2850452 GIT binary patch literal 18384 zcmeHPYiu0V6~4Qh#16!3I|*P&O9n_J=iyyDBxVbwnRUGOx^f;(90=kuS?`X$TlQhi z&Qd3;N~!?r7D8RANG*RFRs4ulsZxKmLj3^=i9l8R103Q8}+Su-gx){Fd^IrpnJ$xmQH2<+ z-<}QW$ZU~6(s%mgJad-#~&E0ei%O#uYMAr z7(cmjVyh5`k|+C!9vt69*4yU|SV*4zBxJ82_+#h#ecb;hr`v&@!HxyB~P3S zB){_K%3rCy9)2|bNc_?GV{xOtj?%x-BP!e3ZCSGB2j2s}2Ye6s9`HTjd%*XA?*ZQf zz6X2{_#XIw@j$@+mDH(mG+Qc|(L%|Z$(ogNv|O32Lc`(mK<8{oyuwc58p*Dlm*6QIMOv`cUm^d->kAJl5+L0k#2&Dk#N`dgNbm@^Pxmo zJGm?o?tN}~GTi^niexx;qHQ#+7sIi5xIZ559SUnh;hv#z*HE}!miuj}&%q9tk<9tQ z_kiyK-vhn}d=K~@@IByr!1sXf0p9~(ln46pTdNF;^0${>x?UBC@l76{z6GVQ${|>& z=`z-#_<3djR>kvo&g&FUYb^@5IYi8>@0w|SMuF3>T&tBNAJU09-)w`PQapci+^cw6 zhf<(59)%knB6<|PNl_;5x2pI(nL<$Bo%JO}d0k51sZzMbAtJj>modg;isy36wIw9* zk*o}yKYqcL_32Ua_;FeC>}M<&CBI6gEA=moxZjm~avW6cJHp?|BYkxD?t8Ufd_lcQ zi{XRe0c~6VKx|;3e}~q4z|3gLl>+nk;!ZkefkZn{Wt zD}NqW?eVmtzCSnr_x?mbXFoD+@;PMqU3>GVJPZ8(T~P1gR(9r;K7D_)RQu8=Iuzbh z^z&?A>YtzGd0FCFkk8@uJWJl^g%tm%&kNd){m8UcyKoxQRx;f7>prCqaNA!|ZAb0+ zX(5CM|8!7q5(!~cJl_%ziHj}qWuiUQ%Fc4Z<8*x{A-uUxwUloYt;WF+-b6fpHriP! zcpPrTZ*a%!MjW#P<-bOJmC#z^9qu^PC?6L5yfxzJ-I`tx$#@7O7oV%DPYmG=Jlj%! zwcz3o-qeV%6|KhckhsY`r_(5pr$yK6AsG*0w$s}Z?-5&D;yl}HG!?=uum4D+ zeGD-;hxLIRx9X*L5)nccDLXyKu@_PzbF>Kfet5ZW^65U5YMK3fGpf-wivf(T+Tp z^8Ej1;N8Ja(XQ-pzQ;&D*!m8I46Fk;VUz#BtEHWe-G3B9bZ=OOv^xkt^ox zNZQLAW-+sfVVY~_(uQT`OX+&qMqKK^eA%wxi{rG&n3g%6E8C`J*ab}ROGUGcrt(I{E?H$GRhbp(Qeh@<+GZwl&$ie-t%Zy!6xB#sR_Z8nvaO?H%1RYXBU339 zjzXo5la*=^g}5QlbD~^keyUH_x^!@{iU6Bjv53j48OF$g_@0E3*gK44q=tc2osmc? zFgbic7{d?kjqe%TjWn|F79i6Iz-yK*jM4FZL-BEA-^j?p#Dp;s9~w^>!Z~`X>-A?$ z4KtInQ^FYAhf}B-G+Cu=W}MThje_!YDjZxc8Cm=Qoi~M%$vdrLAVKsVSJ3)iEgV#?p9>-HJ&0Xu(cRg4&itvmC>5 zThp2mks_9Qk@(P9pPiak+;p)LnXKe+h&hK2NnDl|ijmCGBJ4TTww#nFOsh=mL@A~i z18L~DDN<0enY=9`)IcI)o3psf+C;39baTYas;-pHK$kg3!)a1SgX1uqD&+74O_yK` zw}{NZF$Qmn2zqw`J=Q6gtV|?j+g5I}V&jSU%z^fc@XEy)=>(pi^4|&I{UVhtWjRjt zE?l%n!}>gr<#X{G(&_`h=NZFlt3jXVyBC$g4J@drSAQ7zhuG8M{CQs7PKzG|E=5tP-ZR4Ec%mdB5oaU?j@=r$Rb7+CP)T-6wN6#|FoVK8B0- zs92xp^>2vv6N5L42 zo$y1CK9B$VmB0&Rye_aFLoXsypFgit=GA78yM|T@$}OxePAPr%KhKAR=7`+u5ckgh zW8gF*lt1h9y61k)k+|O>?%kXJuaHu&&+DUE%~6?mHJykz|1*HYxKwv{*HQfUCcN^@ zGyNTOX^(>SdHz1%2M~ef9Bz?k{0~T=zQg*wF5|!F!H(hn#d_S1e}OL5-__rxgTvoj zP!m9wlOS%a&-8s@_4@8Quiw$=Wkp3vig1 zg)Z4t;)pqc^$#58xauA^-pY literal 0 HcmV?d00001 diff --git a/src/try_rmdir.c b/src/try_rmdir.c new file mode 100644 index 0000000..775c02d --- /dev/null +++ b/src/try_rmdir.c @@ -0,0 +1,8 @@ + +#include +#include +int main(){ + int retval = rmdir("/home/morpheus/subuland/ttemp0"); + printf("retval %d\n",retval); + return 0; +} -- 2.20.1