|
 |
06486d |
From 3bdf6305f6a8501a692e1a98f98e0be9d3922a1d Mon Sep 17 00:00:00 2001
|
|
|
06486d |
From: Jakub Filak <jfilak@redhat.com>
|
|
|
06486d |
Date: Wed, 20 May 2015 08:08:58 +0200
|
|
|
06486d |
Subject: [ABRT PATCH] a-a-i-d-t-a-cache: don't open the build_ids file as abrt
|
|
|
06486d |
|
|
|
06486d |
Opening the build_ids file as abrt may lead to information disclosure.
|
|
|
06486d |
|
|
|
06486d |
Related: #1216962
|
|
|
06486d |
|
|
|
06486d |
Signed-off-by: Jakub Filak <jfilak@redhat.com>
|
|
|
06486d |
---
|
|
|
06486d |
.../abrt-action-install-debuginfo-to-abrt-cache.c | 30 +++++++++++++++++-----
|
|
|
06486d |
1 file changed, 23 insertions(+), 7 deletions(-)
|
|
|
06486d |
|
|
|
06486d |
diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
|
|
|
06486d |
index cd9ee7a..fafb0c4 100644
|
|
|
06486d |
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
|
|
|
06486d |
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
|
|
|
06486d |
@@ -72,6 +72,11 @@ int main(int argc, char **argv)
|
|
|
06486d |
};
|
|
|
06486d |
const unsigned opts = parse_opts(argc, argv, program_options, program_usage_string);
|
|
|
06486d |
|
|
|
06486d |
+ const gid_t egid = getegid();
|
|
|
06486d |
+ const gid_t rgid = getgid();
|
|
|
06486d |
+ const uid_t euid = geteuid();
|
|
|
06486d |
+ const gid_t ruid = getuid();
|
|
|
06486d |
+
|
|
|
06486d |
/* We need to open the build ids file under the caller's UID/GID to avoid
|
|
|
06486d |
* information disclosures when reading files with changed UID.
|
|
|
06486d |
* Unfortunately, we cannot replace STDIN with the new fd because ABRT uses
|
|
|
06486d |
@@ -82,7 +87,20 @@ int main(int argc, char **argv)
|
|
|
06486d |
char *build_ids_self_fd = NULL;
|
|
|
06486d |
if (strcmp("-", build_ids) != 0)
|
|
|
06486d |
{
|
|
|
06486d |
+ if (setregid(egid, rgid) < 0)
|
|
|
06486d |
+ perror_msg_and_die("setregid(egid, rgid)");
|
|
|
06486d |
+
|
|
|
06486d |
+ if (setreuid(euid, ruid) < 0)
|
|
|
06486d |
+ perror_msg_and_die("setreuid(euid, ruid)");
|
|
|
06486d |
+
|
|
|
06486d |
const int build_ids_fd = open(build_ids, O_RDONLY);
|
|
|
06486d |
+
|
|
|
06486d |
+ if (setregid(rgid, egid) < 0)
|
|
|
06486d |
+ perror_msg_and_die("setregid(rgid, egid)");
|
|
|
06486d |
+
|
|
|
06486d |
+ if (setreuid(ruid, euid) < 0 )
|
|
|
06486d |
+ perror_msg_and_die("setreuid(ruid, euid)");
|
|
|
06486d |
+
|
|
|
06486d |
if (build_ids_fd < 0)
|
|
|
06486d |
perror_msg_and_die("Failed to open file '%s'", build_ids);
|
|
|
06486d |
|
|
|
06486d |
@@ -118,14 +136,12 @@ int main(int argc, char **argv)
|
|
|
06486d |
/* Switch real user/group to effective ones.
|
|
|
06486d |
* Otherwise yum library gets confused - gets EPERM (why??).
|
|
|
06486d |
*/
|
|
|
06486d |
- gid_t g = getegid();
|
|
|
06486d |
/* do setregid only if we have to, to not upset selinux needlessly */
|
|
|
06486d |
- if (g != getgid())
|
|
|
06486d |
- IGNORE_RESULT(setregid(g, g));
|
|
|
06486d |
- uid_t u = geteuid();
|
|
|
06486d |
- if (u != getuid())
|
|
|
06486d |
+ if (egid != rgid)
|
|
|
06486d |
+ IGNORE_RESULT(setregid(egid, egid));
|
|
|
06486d |
+ if (euid != ruid)
|
|
|
06486d |
{
|
|
|
06486d |
- IGNORE_RESULT(setreuid(u, u));
|
|
|
06486d |
+ IGNORE_RESULT(setreuid(euid, euid));
|
|
|
06486d |
/* We are suid'ed! */
|
|
|
06486d |
/* Prevent malicious user from messing up with suid'ed process: */
|
|
|
06486d |
#if 1
|
|
|
06486d |
@@ -179,7 +195,7 @@ int main(int argc, char **argv)
|
|
|
06486d |
// abrt-action-install-debuginfo doesn't fail when spawning
|
|
|
06486d |
// abrt-action-trim-files
|
|
|
06486d |
char path_env[] = "PATH=/usr/sbin:/sbin:/usr/bin:/bin:"BIN_DIR":"SBIN_DIR;
|
|
|
06486d |
- if (u != 0)
|
|
|
06486d |
+ if (euid != 0)
|
|
|
06486d |
strcpy(path_env, "PATH=/usr/bin:/bin:"BIN_DIR);
|
|
|
06486d |
putenv(path_env);
|
|
|
06486d |
|
|
|
06486d |
--
|
|
|
06486d |
1.8.3.1
|
|
|
06486d |
|