.\" -*- mode: troff; coding: utf-8 -*- .\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>. .ie n \{\ . ds C` "" . ds C' "" 'br\} .el\{\ . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" ======================================================================== .\" .IX Title "Paranoid 3pm" .TH Paranoid 3pm 2024-03-07 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH NAME Paranoid \- Paranoia support for safer programs .SH VERSION .IX Header "VERSION" \&\f(CW$Id:\fR lib/Paranoid.pm, 2.10 2022/03/08 00:01:04 acorliss Exp $ .SH SYNOPSIS .IX Header "SYNOPSIS" .Vb 1 \& use Paranoid; \& \& $errMsg = Paranoid::ERROR; \& \& psecureEnv("/bin:/usr/bin"); \& \& sub foo { \& # this function can return \*(Aq0\*(Aq as a valid return value \& # that should be construed as a boolean true value \& \& return PTRUE_ZERO; \& } .Ve .SH DESCRIPTION .IX Header "DESCRIPTION" This collection of modules started out as modules which perform things (debatably) in a safer and taint-safe manner. Since then it's also grown to include functionality that fit into the same framework and conventions of the original modules, including keeping the debug hooks for command-line debugging. .PP All the modules below are intended to be used directly in your programs if you need the functionality they provide. .PP This module does provide one function meant to secure your environment enough to satisfy taint-enabled programs, and as a container which holds the last reported error from any code in the Paranoid framework. .SH "IMPORT LISTS" .IX Header "IMPORT LISTS" This module exports the following symbols by default: .PP .Vb 1 \& psecureEnv .Ve .PP The following specialized import lists also exist: .PP .Vb 3 \& List Members \& \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- \& all @defaults PTRUE_ZERO .Ve .SH SUBROUTINES/METHODS .IX Header "SUBROUTINES/METHODS" .SS psecureEnv .IX Subsection "psecureEnv" .Vb 1 \& psecureEnv("/bin:/usr/bin"); .Ve .PP This function deletes some of the dangerous environment variables that can be used to subvert perl when being run in setuid applications. It also sets the path, either to the passed argument (if passed) or a default of "/bin:/sbin:/usr/bin:/usr/sbin". .PP \&\fBNOTE:\fR I did explicitly exclude \fI/usr/local\fR directories from the default path for the following reason: \fI/usr/local\fR is often used by admins to stash random scripts and programs which may not have undergone any serious scrutiny and review for security issues. Only the base OS directories are presumed as safe, and even that may be stretching the truth as it is. You can override the defaults as desired. .SS Paranoid::ERROR .IX Subsection "Paranoid::ERROR" .Vb 2 \& $errMsg = Paranoid::ERROR; \& Paranoid::ERROR = $errMsg; .Ve .PP This lvalue function is not exported and must be referenced via the \&\fBParanoid\fR namespace. .SS PTRUE_ZERO .IX Subsection "PTRUE_ZERO" This is a constant that evaluates to '0 but true', which allows \fI0\fR to be passed for boolean true use-cases. .SH "TAINT NOTES" .IX Header "TAINT NOTES" Taint-mode programming can be somewhat of an adventure until you know all the places considered dangerous under perl's taint mode. The following functions should generally have their arguments detainted before using: .PP .Vb 7 \& exec system open glob \& unlink mkdir chdir rmdir \& chown chmod umask utime \& link symlink kill eval \& truncate ioctl fcntl chroot \& setpgrp setpriority syscall socket \& socketpair bind connect .Ve .SH DEPENDENCIES .IX Header "DEPENDENCIES" While this module itself doesn't have any external dependencies various child modules do. Please check their documentation for any particulars should you use them. .SH "SEE ALSO" .IX Header "SEE ALSO" The following modules are available for use. You should check their POD for specifics on use: .IP o 4 .IX Item "o" Paranoid::Args: Command-line argument parsing functions .IP o 4 .IX Item "o" Paranoid::Data: Misc. data manipulation functions .IP o 4 .IX Item "o" Paranoid::Data::AVLTree: AVL-Balanced Tree Class .IP o 4 .IX Item "o" Paranoid::Data::AVLTree::AVLNode: AVL-Balanced Tree Node Class .IP o 4 .IX Item "o" Paranoid::Debug: Command-line debugging framework and functions .IP o 4 .IX Item "o" Paranoid::Filesystem: Filesystem operation functions .IP o 4 .IX Item "o" Paranoid::Glob: Paranoid Glob objects .IP o 4 .IX Item "o" Paranoid::IO: File I/O wrappers for sysopen, etc. .IP o 4 .IX Item "o" Paranoid::IO::FileMultiplexer: File Multiplexer Object .IP o 4 .IX Item "o" Paranoid::IO::FileMultiplexer::Block: Block-level Allocator/Accessor .IP o 4 .IX Item "o" Paranoid::IO::FileMultiplexer::Block::BATHeader: BAT Header Block .IP o 4 .IX Item "o" Paranoid::IO::FileMultiplexer::Block::FileHeader: File Header Block .IP o 4 .IX Item "o" Paranoid::IO::FileMultiplexer::Block::StreamHeader: Stream Header Block .IP o 4 .IX Item "o" Paranoid::IO::Line: I/O functions for working with line-based files .IP o 4 .IX Item "o" Paranoid::IO::Lockfile: I/O functions for working with lock files .IP o 4 .IX Item "o" Paranoid::Input: Input-related functions (file reading, detainting) .IP o 4 .IX Item "o" Paranoid::Log: Unified logging framework and functions .IP o 4 .IX Item "o" Paranoid::Log::Buffer: Buffered-based logging mechanism .IP o 4 .IX Item "o" Paranoid::Log::File: File-based logging mechanism .IP o 4 .IX Item "o" Paranoid::Module: Run-time module loading functions .IP o 4 .IX Item "o" Paranoid::Network: Network-related functions .IP o 4 .IX Item "o" Paranoid::Network::IPv4: General IPv4\-related functions .IP o 4 .IX Item "o" Paranoid::Network::IPv6: General IPv6\-related functions .IP o 4 .IX Item "o" Paranoid::Network::Socket: Wrapper module for Socket & Socket6 .IP o 4 .IX Item "o" Paranoid::Process: Process management functions .SH "BUGS AND LIMITATIONS" .IX Header "BUGS AND LIMITATIONS" .SH AUTHOR .IX Header "AUTHOR" Arthur Corliss (corliss@digitalmages.com) .SH "LICENSE AND COPYRIGHT" .IX Header "LICENSE AND COPYRIGHT" This software is free software. Similar to Perl, you can redistribute it and/or modify it under the terms of either: .PP .Vb 7 \& a) the GNU General Public License \& as published by the \& Free Software Foundation ; either version 1 \& , or any later version \& , or \& b) the Artistic License 2.0 \& , .Ve .PP subject to the following additional term: No trademark rights to "Paranoid" have been or are conveyed under any of the above licenses. However, "Paranoid" may be used fairly to describe this unmodified software, in good faith, but not as a trademark. .PP (c) 2005 \- 2020, Arthur Corliss (corliss@digitalmages.com) (tm) 2008 \- 2020, Paranoid Inc. (www.paranoid.com)