Browse files

significantly increase performance by only handling input line-by-lin…

…e if we are in trace mode
  • Loading branch information...
1 parent 32fbffb commit 2e975b08b9c992594f67d562f1c39463ceb3cc9d @jschauma committed Aug 7, 2011
Showing with 204 additions and 4 deletions.
  1. +3 −0 CHANGES
  2. +191 −0 doc/sigsh.1.html
  3. +10 −4 src/sigsh.sh
View
3 CHANGES
@@ -0,0 +1,3 @@
+2011-08-07:
+ * significantly increase performance by only handling input line-by-line
+ if we are in trace mode
View
191 doc/sigsh.1.html
@@ -0,0 +1,191 @@
+<!-- manual page source format generated by PolyglotMan v3.2, -->
+<!-- available at http://polyglotman.sourceforge.net/ -->
+
+<html>
+<head>
+<title>man page(1) manual page</title>
+</head>
+<body bgcolor='white'>
+<a href='#toc'>Table of Contents</a><p>
+
+<h2><a name='sect0' href='#toc0'>Name</a></h2>
+
+<p>
+<b>sigsh</b> -- a signature verifying shell
+
+<p>
+<h2><a name='sect1' href='#toc1'><b>Synopsis</b></a></h2>
+
+<p>
+<b>sigsh</b> [<b>-c</b> <i>certs</i>] [<b>-x</b>] [<b>-p</b> <i>prog</i>]
+
+<p>
+<h2><a name='sect2' href='#toc2'><b>Description</b></a></h2>
+
+<p>
+<b>sigsh</b> is a non-interactive, signature requiring and verifying command
+interpreter. More accurately, it is a signature verification wrapper
+around a given shell. It reads input in PKCS#7 format from standard in,
+verifies the signature and, if the signature matches, pipes the decoded
+input into the command interpreter.
+
+<p>
+<h2><a name='sect3' href='#toc3'><b>Options</b></a></h2>
+
+<p>
+<b>sigsh</b> supports the following flags:
+
+<p>
+<dl>
+
+<dt><b>-c</b> <i>certs</i> </dt></dt>
+<dd>Read ceritificates to trust from this file.
+
+<p></dd>
+
+<dt><b>-p</b> <i>prog</i> </dt></dt>
+<dd>Pipe commands into this interpreter instead of the default
+<a href='bash.1'>bash(1)</a>
+.
+
+<p></dd>
+
+<dt><b>-x</b> </dt></dt>
+<dd> Enable debugging (mnemomic &lsquo;xtrace&rsquo;, as <a href='sh.1'>sh(1)</a>
+).
+
+<p></dd>
+</dl>
+
+<h2><a name='sect4' href='#toc4'><b>Details</b></a></h2>
+
+<p>
+Conceptually similar to Microsoft Windows&rsquo; Powershell ExecutionPolicy (as
+set to &lsquo;allSigned&rsquo;), <b>sigsh</b> will only execute any commands from the input
+if a valid signature is found. This allows, for example, a headless user
+to be able to run any arbitrary set of commands (if provided by trusted
+entities) without having to give it a fully interactive login shell. By
+specifying a different interpreter to which to pass the verified input,
+<b>sigsh</b> can be used for almost anything requiring input verification so
+long as the tool invoked accepts input from standard in.
+
+<p><p>
+<b>sigsh</b> is intentionally kept as simple as possible and does not provide
+for a whole lot of customization via either a startup file or any command-line
+options.
+
+<p>
+<h2><a name='sect5' href='#toc5'><b>Input</b></a></h2>
+
+<p>
+<b>sigsh</b> reads input from standard in. That is, unlike other interactive
+command interpreters, it cannot be invoked from the terminal to read commands
+one at a time. <b>sigsh</b> relies on (and shells out to) <a href='openssl.1'>openssl(1)</a>
+ for
+signature verification. In particular, it expects input to be in PKCS#7
+format, containing signed data to be passed to the command interpreter.
+In order to verify the signature, <b>sigsh</b> needs to have available a matching
+certificate (see section FILES).
+
+<p>
+<h2><a name='sect6' href='#toc6'><b>Output</b></a></h2>
+
+<p>
+By default, <b>sigsh</b> does not generate any output itself. If input verification
+fails, it will return an error code (see section EXIT STATUS) and
+print a brief message to STDERR; otherwise, it will pipe the validated
+input to the given command interpreter, letting it generate any and all
+output (both to standard out and standard error).
+
+<p>
+<h2><a name='sect7' href='#toc7'><b>Examples</b></a></h2>
+
+<p>
+The following examples illustrate possible usage of this tool.
+
+<p><p>
+To execute the commands in the file &lsquo;script.bash&rsquo;:
+
+<p><p>
+openssl smime -sign -nodetach -signer mycert.pem -inkey mykey.pem \
+-in script.bash -outform pem | sigsh
+
+<p><p>
+To execute the perl code contained in the signed PKCS#7 file &lsquo;code.pem&rsquo;:
+
+<p><p>
+sigsh -p /usr/bin/perl &lt; code.pem
+
+<p>
+<h2><a name='sect8' href='#toc8'><b>Exit</b> <b>Status</b></a></h2>
+
+<p>
+<b>sigsh</b> will exit with the rather unusual return code of 127 if verification
+of the input fails (for whatever reason). Otherwise, it will return
+the exit code of the interpreter invoked.
+
+<p>
+<h2><a name='sect9' href='#toc9'><b>Environment</b></a></h2>
+
+<p>
+<b>sigsh</b> clears the environment before passing the verified input on to the
+interpreter. Therefor, the input must make sure to explicitly set any
+variables it may rely on.
+
+<p>
+<h2><a name='sect10' href='#toc10'><b>Files</b></a></h2>
+
+<p>
+<b>sigsh</b> uses the following files:
+
+<p>
+<dl>
+
+<dt>/etc/sigsh.pem </dt></dt>
+<dd>The file containing all certificates that <b>sigsh</b> will
+verify the input against.
+
+<p></dd>
+</dl>
+
+<h2><a name='sect11' href='#toc11'><b>See</b> <b>Also</b></a></h2>
+
+<p>
+<a href='openssl.1'>openssl(1)</a>
+, <a href='smime.1'>smime(1)</a>
+
+
+<p>
+<h2><a name='sect12' href='#toc12'><b>History</b></a></h2>
+
+<p>
+<b>sigsh</b> was originally written by Jan Schaumann &lt;jschauma@yahoo-inc.com&gt; in
+September 2010.
+
+<p>
+<h2><a name='sect13' href='#toc13'><b>Bugs</b></a></h2>
+
+<p>
+Please report bugs and feature requests to the author.
+<p>
+
+<hr><p>
+<a name='toc'><b>Table of Contents</b></a><p>
+<ul>
+<li><a name='toc0' href='#sect0'>Name</a></li>
+<li><a name='toc1' href='#sect1'>Synopsis</a></li>
+<li><a name='toc2' href='#sect2'>Description</a></li>
+<li><a name='toc3' href='#sect3'>Options</a></li>
+<li><a name='toc4' href='#sect4'>Details</a></li>
+<li><a name='toc5' href='#sect5'>Input</a></li>
+<li><a name='toc6' href='#sect6'>Output</a></li>
+<li><a name='toc7' href='#sect7'>Examples</a></li>
+<li><a name='toc8' href='#sect8'>Exit Status</a></li>
+<li><a name='toc9' href='#sect9'>Environment</a></li>
+<li><a name='toc10' href='#sect10'>Files</a></li>
+<li><a name='toc11' href='#sect11'>See Also</a></li>
+<li><a name='toc12' href='#sect12'>History</a></li>
+<li><a name='toc13' href='#sect13'>Bugs</a></li>
+</ul>
+</body>
+</html>
View
14 src/sigsh.sh
@@ -170,7 +170,13 @@ fi
IFS='
'
-for line in ${output}; do
- xtrace "${line}"
- echo "${line}" | tr -d '\r'
-done | ${PROGRAM}
+# We only loop through this line by line if we're tracing. Otherwise,
+# this would be a significant performance penalty for large input scripts.
+if [ ${XTRACE} -gt 0 ]; then
+ for line in ${output}; do
+ xtrace "${line}"
+ echo "${line}" | tr -d '\r'
+ done | ${PROGRAM}
+else
+ echo "${output}" | tr -d '\r' | ${PROGRAM}
+fi

0 comments on commit 2e975b0

Please sign in to comment.