Gecko [ absoluteplasticsltd.com ]

Name	Size	Permission	Date
050bbf7669362664f13d8793d268df4a65a3df	14.98 KB	-rwxr-xr-x	2023-07-07 00:00
06f2c82161310460dda87c33ab5263ff0ff6b5	32.32 KB	-rwxr-xr-x	2026-08-31 00:00
1be3e78d17b52fd66bdfc6edb3c78eaf8ed54d	15.13 KB	-rwxr-xr-x	2024-09-24 00:00
1c4c55fcc5d29b1868ba0185e201773c0cdf6e	31.26 KB	-rwxr-xr-x	2025-10-27 00:00
3f876fea7948829ead333627e907fac2d26279	14.83 KB	-rwxr-xr-x	2026-09-10 00:00
493988972ed363948e381ef14c6c08c2dec058	27.33 KB	-rwxr-xr-x	2024-10-29 00:00
4b2d9605068c3e3fe1f9cf185f7f9aa5c94c9f	23.2 KB	-rwxr-xr-x	2024-10-29 00:00
4f5d6fe57c60e77d91dc192dd3f8d3cee78de2	18.77 KB	-rwxr-xr-x	2026-07-23 00:00
58bcb75f95d19a2fac829464162b5030b91634	15.45 KB	-rwxr-xr-x	2026-08-04 00:00
685a75e162107a39d571aff3a4c223b0f2d844	463.16 KB	-rwxr-xr-x	2026-09-22 00:00
68de05b93246ee30126d5e8986787c8ff48022	15.19 KB	-rwxr-xr-x	2023-07-07 00:00
6d2e60f8e5fd8a3c6782b88a3b7d7ceee566a4	14.2 KB	-rwxr-xr-x	2024-12-15 00:00
717dbdb4c5c3cacd849b9453e4dbbb6084574b	96.59 KB	-rwxr-xr-x	2024-10-29 00:00
77e837d2aed545e472703b38eb9d67c32af1e2	246.95 KB	-rwxr-xr-x	2023-07-07 00:00
7c574ff1c3592040c2f58a1c5b22c095e5b3c0	2.78 MB	-rwxr-xr-x	2025-10-27 00:00
90e600f0e6a65d02a34e533a1e8e026f752be6	23.13 KB	-rwxr-xr-x	2026-07-21 00:00
99267124d8491b4aa3cb5417b26cef13f00465	14.95 KB	-rwxr-xr-x	2026-09-10 00:00
abb55a96307b740bceacf3aca97850fe009e9c	570.73 KB	-rwxr-xr-x	2026-09-10 00:00
becda2f375908c1bc5e9eb4f225a2a8a04fda3	15.02 KB	-rwxr-xr-x	2010-07-04 00:00
c0777baf39e92d0f1f57a744e12656c59cc9c9	228.42 KB	-rwxr-xr-x	2025-10-27 00:00
cd806e59b9bfb4ed6027b6d0ad02b5c4cca671	223.43 KB	-rwxr-xr-x	2026-01-22 00:00
d2e3580db9884c4ad84766a216097ff42e61d7	198.91 KB	-rwxr-xr-x	2026-09-10 00:00
e312f9daae41b5f4ce53d074b68cf0f8356021	5.89 KB	-rwxr-xr-x	2026-07-30 00:00
e86eb2ba75854afbc3cb9687ed614d032c0d12	23.42 KB	-rwxr-xr-x	2024-07-26 00:00
e8feab45dfbb8af3e566da8820412e894bc23c	81 KB	-rwxr-xr-x	2026-08-13 00:00

Rename

#!/usr/bin/bash
##CageFS proxyexec wrapper - ver 18

if [[ $EUID -eq 0 ]]; then
    echo 'Cannot be run as root'
    exit 1
fi

# POSIX single-quote escaping for values embedded in the ssh remote
# command. Unlike `printf %q`, single-quoted output re-parses correctly
# under any POSIX shell (the origin login shell need not be bash) and is
# lossless for arbitrary bytes. Each embedded ' becomes the '\'' sequence.
sq() {
    local s=${1//\'/\'\\\'\'}
    printf "'%s'" "$s"
}

USR=`/usr/bin/whoami`
USER_TOKEN_PATH="/var/.cagefs/.cagefs.token"
WEBSITE_ISOLATION_FLAG="/opt/cloudlinux/flags/enabled-flags.d/website-isolation.flag"
# Trust boundary for the website-isolation token path: it must point
# directly at the regular file that create_website_token_directory()
# creates inside its root-owned per-user storage area. That area is
# /var/cagefs/<prefix>/<user>/.cagefs/website/... on the host and is
# bind-mounted into the cage at /var/.cagefs/website/... — both views
# are accepted because libenter.enter_site() picks one or the other
# depending on whether it runs inside or outside the cage. The file
# itself is never a symlink, so we reject symlinks outright rather
# than canonicalizing with realpath. Without this gate the attacker
# controls both the env var WEBSITE_TOKEN_PATH and the file contents
# at that path; the file contents land in $TOKEN, which is embedded
# into the ssh remote command argv below and re-parsed by the remote
# shell — so shell metacharacters in the file would execute on the
# origin host. (Slite #7 / CLOS-4490)
if [[ -f "$WEBSITE_ISOLATION_FLAG" && -n "$WEBSITE_TOKEN_PATH" ]]; then
    if [[ -L "$WEBSITE_TOKEN_PATH" ]]; then
        echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not be a symlink" >&2
        exit 1
    fi
    if [[ ! -f "$WEBSITE_TOKEN_PATH" ]]; then
        echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' is not an existing regular file" >&2
        exit 1
    fi
    # Reject `..` as a path component so the prefix check below cannot
    # be bypassed via traversal (e.g. /var/cagefs/../etc/passwd matches
    # the /var/cagefs/* glob but resolves outside the trusted area).
    case "$WEBSITE_TOKEN_PATH" in
        */../*|*/..)
            echo "cagefs.proxy: WEBSITE_TOKEN_PATH '$WEBSITE_TOKEN_PATH' must not contain '..' path components" >&2
            exit 1
            ;;
    esac
    case "$WEBSITE_TOKEN_PATH" in
        /var/cagefs/*|/var/.cagefs/*) ;;
        *)
            echo "cagefs.proxy: WEBSITE_TOKEN_PATH must be under /var/cagefs/ or /var/.cagefs/ (got '$WEBSITE_TOKEN_PATH')" >&2
            exit 1
            ;;
    esac
    USER_TOKEN_PATH="$WEBSITE_TOKEN_PATH"
fi
# The -L/-f/prefix gate above is defense-in-depth, TOCTOU is not exploitable because the
# forwarded $TOKEN must still equal the legit on-disk bytes that the
# origin's cagefs.server reads with open(..., O_NOFOLLOW) from a
# uid-derived path (see find_website_by_token() in
# proxyexec/cagefs.server.c) — a swapped symlink redirects what we
# cat, never what the server reads, so a TOCTOU substitution can only
# replace the forwarded bytes with something that fails the server's
# constant-time comparison.
TOKEN=`/bin/cat ${USER_TOKEN_PATH}`
# Tokens are generated as fixed-length alphanumerics by
# _generate_password() in py/clcagefslib/webisolation/jail_utils.py and
# by the corresponding C helper. Any non-alphanumeric byte means the
# token file was tampered with — refuse to forward it into the ssh
# remote command, where the remote shell would re-parse metacharacters.
# Use POSIX `case` rather than `[[ =~ ]]` because the wrapper is also
# invoked through `sh` (e.g. jenkins_tests/rpm_tests/p_cagefs/
# 939-environment_var-check.sh), and dash treats `[[` as a missing
# command — the regex form would falsely trip and exit the script.
case "$TOKEN" in
    "" | *[!A-Za-z0-9]*)
        echo "cagefs.proxy: refusing to forward malformed token from $USER_TOKEN_PATH" >&2
        exit 1
        ;;
esac
# It's user's tmp directory and write to it is secure procedure
# because this script is running only under usual user
PIDFILE="/tmp/.cagefs.proxy.$$"
USER_INTERRUPT=13
CWD=`pwd`

ctrl_c_handler() {
    if [[ -f "$PIDFILE" ]]; then
        pid=`/bin/cat $PIDFILE`
        /bin/rm -f $PIDFILE > /dev/null 2>&1
        /bin/kill -s SIGINT "$pid" > /dev/null 2>&1
    fi
    exit $USER_INTERRUPT
}

if [[ -e /var/.cagefs/origin ]]; then
    ORIGIN=`/bin/cat /var/.cagefs/origin`
    # ssh(1) joins the remote-command argv with single spaces and ships
    # the result for the origin user's login shell to re-parse. The local
    # bash double-quotes around "$CWD" and "$@" only protect parsing on
    # THIS host — once ssh has taken the argv, the quoting is gone and
    # any shell metacharacter embedded in $CWD (`pwd`, attacker controls
    # via mkdir+cd inside the cage) or in any "$@" element (caller argv
    # for sendmail/crontab/etc.) is interpreted by the remote shell.
    # CLOS-4490 hardened $TOKEN by content validation; that approach
    # does not work for $CWD or $@ (legitimate paths/args may contain
    # spaces, parens, ampersands), so we single-quote each caller-
    # controlled element with sq() before composing the remote command.
    # ssh re-parses the command only once (the origin login shell), so a
    # single quoting pass per value is enough here. $USR is `whoami` so
    # it cannot contain metacharacters in any sane account database, but
    # we quote it too for defense in depth. (CLOS-4596)
    Q_ARGS=
    for _arg in "$@"; do
        Q_ARGS="$Q_ARGS $(sq "$_arg")"
    done
    /usr/bin/ssh -F /etc/ssh/cagefs-rexec_config "$USR@$ORIGIN" \
        "CAGEFS_TOKEN=$TOKEN /usr/sbin/proxyexec -c cagefs.sock $(sq "$USR") $(sq "$CWD") USERDOMAINS $$$Q_ARGS"
    RETVAL=$?
else
    trap 'ctrl_c_handler' 2
    CAGEFS_TOKEN="$TOKEN" /usr/sbin/proxyexec -c cagefs.sock "$USR" "$CWD" USERDOMAINS $$ "$@"
    RETVAL=$?
    /bin/rm -f $PIDFILE > /dev/null 2>&1
fi

exit $RETVAL