From 86f6453de032f012deae5af921cdac9b39472c55 Mon Sep 17 00:00:00 2001
From: maxnet <bos@je-eigen-domein.nl>
Date: Tue, 4 Feb 2020 14:16:00 +0100
Subject: [PATCH] Allow members of plugdev group to execute rpiboot without root (#27)

---
 debian/99-rpiboot.rules |  1 +
 debian/rpiboot.install  |  1 +
 main.c                  | 28 ++++++++++++++++------------
 3 files changed, 18 insertions(+), 12 deletions(-)
 create mode 100644 debian/99-rpiboot.rules

diff --git a/debian/99-rpiboot.rules b/debian/99-rpiboot.rules
new file mode 100644
index 0000000..b04d29a
--- /dev/null
+++ b/debian/99-rpiboot.rules
@@ -0,0 +1 @@
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="0a5c", ATTR{idProduct}=="276[34]", GROUP="plugdev"
diff --git a/debian/rpiboot.install b/debian/rpiboot.install
index 5df7802..349c2f0 100644
--- a/debian/rpiboot.install
+++ b/debian/rpiboot.install
@@ -1,2 +1,3 @@
 rpiboot usr/bin
 msd usr/share/rpiboot
+debian/99-rpiboot.rules /lib/udev/rules.d
diff --git a/main.c b/main.c
index 56e80f5..bae94bc 100644
--- a/main.c
+++ b/main.c
@@ -129,7 +129,12 @@ libusb_device_handle * LIBUSB_CALL open_device_with_vid(
 	if (found) {
 		sleep(1);
 		r = libusb_open(found, &handle);
-		if (r < 0)
+		if (r == LIBUSB_ERROR_ACCESS)
+		{
+			printf("Permission to access USB device denied. Make sure you are a member of the plugdev group.\n");
+			exit(-1);
+		}
+		else if (r < 0)
 		{
 			if(verbose) printf("Failed to open the requested device\n");
 			handle = NULL;
@@ -398,6 +403,13 @@ FILE * check_file(char * dir, char *fname)
 	FILE * fp = NULL;
 	char path[256];
 
+	// Prevent USB device from requesting files in parent directories
+	if(strstr(fname, ".."))
+	{
+		printf("Denying request for filename containing .. to prevent path traversal\n");
+		return NULL;
+	}
+
 	// Check directory first then /usr/share/rpiboot
 	if(dir)
 	{
@@ -566,17 +578,9 @@ int main(int argc, char *argv[])
 	// flush immediately
 	setbuf(stdout, NULL);
 
-#if defined (__CYGWIN__)
-	//printf("Running under Cygwin\n");
-#else
-	//exit if not run as sudo
-	if(getuid() != 0)
-	{
-		printf("Must be run with sudo...\n");
-		exit(-1);
-	}
-#endif
-
+	// Default to standard msd directory
+	if(directory == NULL)
+		directory = "msd";
 
 	second_stage = check_file(directory, "bootcode.bin");
 	if(second_stage == NULL)
--
libgit2 0.21.4