Blame SOURCES/autofs-5.1.0-add-config-option-to-force-use-of-program-map-stdvars.patch

304803
autofs-5.1.0 - add config option to force use of program map stdvars
304803
304803
From: Ian Kent <ikent@redhat.com>
304803
304803
Enabling the extended environment (including $HOME, for example) for
304803
program maps opens automount(8) to a privilege escalation.
304803
304803
Rather than just removing the entended environment a configuration
304803
option is added to disable it by default so that those who wish to
304803
use it can do so if they wish.
304803
---
304803
 CHANGELOG                      |    1 +
304803
 include/defaults.h             |    2 ++
304803
 lib/defaults.c                 |   12 ++++++++++++
304803
 man/autofs.5                   |    5 +++++
304803
 man/autofs.conf.5.in           |    9 +++++++++
304803
 modules/lookup_program.c       |   14 +++++++++++++-
304803
 redhat/autofs.conf.default.in  |   11 +++++++++++
304803
 samples/autofs.conf.default.in |   11 +++++++++++
304803
 8 files changed, 64 insertions(+), 1 deletion(-)
304803
304803
--- autofs-5.0.7.orig/CHANGELOG
304803
+++ autofs-5.0.7/CHANGELOG
304803
@@ -163,6 +163,7 @@
304803
 - ensure negative cache isn't updated on remount.
304803
 - dont add wildcard to negative cache.
304803
 - add a prefix to program map stdvars.
304803
+- add config option to force use of program map stdvars.
304803
 
304803
 25/07/2012 autofs-5.0.7
304803
 =======================
304803
--- autofs-5.0.7.orig/include/defaults.h
304803
+++ autofs-5.0.7/include/defaults.h
304803
@@ -30,6 +30,7 @@
304803
 #define DEFAULT_UMOUNT_WAIT		"12"
304803
 #define DEFAULT_BROWSE_MODE		"1"
304803
 #define DEFAULT_LOGGING			"none"
304803
+#define DEFAULT_FORCE_STD_PROG_MAP_ENV	"0"
304803
 
304803
 #define DEFAULT_LDAP_TIMEOUT		"-1"
304803
 #define DEFAULT_LDAP_NETWORK_TIMEOUT	"8"
304803
@@ -151,6 +152,7 @@ unsigned int defaults_get_timeout(void);
304803
 unsigned int defaults_get_negative_timeout(void);
304803
 unsigned int defaults_get_browse_mode(void);
304803
 unsigned int defaults_get_logging(void);
304803
+unsigned int defaults_force_std_prog_map_env(void);
304803
 const char *defaults_get_ldap_server(void);
304803
 unsigned int defaults_get_ldap_timeout(void);
304803
 unsigned int defaults_get_ldap_network_timeout(void);
304803
--- autofs-5.0.7.orig/lib/defaults.c
304803
+++ autofs-5.0.7/lib/defaults.c
304803
@@ -50,6 +50,7 @@
304803
 #define NAME_NEGATIVE_TIMEOUT		"negative_timeout"
304803
 #define NAME_BROWSE_MODE		"browse_mode"
304803
 #define NAME_LOGGING			"logging"
304803
+#define NAME_FORCE_STD_PROG_MAP_ENV	"force_standard_program_map_env"
304803
 
304803
 #define NAME_LDAP_URI			"ldap_uri"
304803
 #define NAME_LDAP_TIMEOUT		"ldap_timeout"
304803
@@ -1589,6 +1590,17 @@ unsigned int defaults_get_logging(void)
304803
 	return logging;
304803
 }
304803
 
304803
+unsigned int defaults_force_std_prog_map_env(void)
304803
+{
304803
+	int res;
304803
+
304803
+	res = conf_get_yesno(autofs_gbl_sec, NAME_FORCE_STD_PROG_MAP_ENV);
304803
+	if (res < 0)
304803
+		res = atoi(DEFAULT_FORCE_STD_PROG_MAP_ENV);
304803
+
304803
+	return res;
304803
+}
304803
+
304803
 unsigned int defaults_get_ldap_timeout(void)
304803
 {
304803
 	int res;
304803
--- autofs-5.0.7.orig/man/autofs.5
304803
+++ autofs-5.0.7/man/autofs.5
304803
@@ -190,6 +190,11 @@ SHOST	Short hostname (domain part remove
304803
 .fi
304803
 .RE
304803
 .sp
304803
+If a program map is used these standard environment variables will have
304803
+a prefix of "AUTOFS_" to prevent interpreted languages like python from
304803
+being able to load and execute arbitray code from a user home directory.
304803
+.RE
304803
+.sp
304803
 Additional entries can be defined with the -Dvariable=Value map-option to
304803
 .BR automount (8).
304803
 .SS Executable Maps
304803
--- autofs-5.0.7.orig/man/autofs.conf.5.in
304803
+++ autofs-5.0.7/man/autofs.conf.5.in
304803
@@ -71,6 +71,15 @@ options replace the global options (prog
304803
 .B logging
304803
 .br
304803
 set default log level "none", "verbose" or "debug" (program default "none").
304803
+.TP
304803
+.B force_standard_program_map_env
304803
+.br
304803
+override the use of a prefix with standard environment variables when a
304803
+program map is executed. Since program maps are run as the privileded
304803
+user setting these standard environment variables opens automount(8) to
304803
+potential user privilege escalation when the program map is written in a
304803
+language that can load components from, for example, a user home directory
304803
+(program default "no").
304803
 .SS LDAP Configuration
304803
 .P
304803
 Configuration settings available are:
304803
--- autofs-5.0.7.orig/modules/lookup_program.c
304803
+++ autofs-5.0.7/modules/lookup_program.c
304803
@@ -129,6 +129,7 @@ static char *lookup_one(struct autofs_po
304803
 	int distance;
304803
 	int alloci = 1;
304803
 	int status;
304803
+	char *prefix;
304803
 
304803
 	mapent = (char *) malloc(MAPENT_MAX_LEN + 1);
304803
 	if (!mapent) {
304803
@@ -174,6 +175,17 @@ static char *lookup_one(struct autofs_po
304803
 			warn(ap->logopt,
304803
 			     MODPREFIX "failed to set PWD to %s for map %s",
304803
 			     ap->path, ctxt->mapname);
304803
+
304803
+		/*
304803
+		 * By default use a prefix with standard environment
304803
+		 * variables to prevent system subversion by interpreted
304803
+		 * languages.
304803
+		 */
304803
+		if (defaults_force_std_prog_map_env())
304803
+			prefix = NULL;
304803
+		else
304803
+			prefix = "AUTOFS_";
304803
+
304803
 		/*
304803
 		 * MAPFMT_DEFAULT must be "sun" for ->parse_init() to have setup
304803
 		 * the macro table.
304803
@@ -181,7 +193,7 @@ static char *lookup_one(struct autofs_po
304803
 		if (ctxt->mapfmt && strcmp(ctxt->mapfmt, "MAPFMT_DEFAULT")) {
304803
 			struct parse_context *pctxt = (struct parse_context *) ctxt->parse->context;
304803
 			/* Add standard environment as seen by sun map parser */
304803
-			pctxt->subst = addstdenv(pctxt->subst, "AUTOFS_");
304803
+			pctxt->subst = addstdenv(pctxt->subst, prefix);
304803
 			macro_setenv(pctxt->subst);
304803
 		}
304803
 		execl(ctxt->mapname, ctxt->mapname, name, NULL);
304803
--- autofs-5.0.7.orig/redhat/autofs.conf.default.in
304803
+++ autofs-5.0.7/redhat/autofs.conf.default.in
304803
@@ -53,6 +53,17 @@ mount_nfs_default_protocol = 4
304803
 #
304803
 #logging = none
304803
 #
304803
+# force_standard_program_map_env - disable the use of the "AUTOFS_"
304803
+#			prefix for standard environemt variables when
304803
+#			executing a program map. Since program maps
304803
+#			are run as the privileded user this opens
304803
+#			automount(8) to potential user privilege
304803
+#			escalation when the program map is written
304803
+#			in a language that  can load components from,
304803
+#			for example, a user home directory.
304803
+#
304803
+# force_standard_program_map_env = no
304803
+#
304803
 # Define base dn for map dn lookup.
304803
 #
304803
 # Define server URIs
304803
--- autofs-5.0.7.orig/samples/autofs.conf.default.in
304803
+++ autofs-5.0.7/samples/autofs.conf.default.in
304803
@@ -52,6 +52,17 @@ browse_mode = no
304803
 #
304803
 #logging = none
304803
 #
304803
+# force_standard_program_map_env - disable the use of the "AUTOFS_"
304803
+#			prefix for standard environemt variables when
304803
+#			executing a program map. Since program maps
304803
+#			are run as the privileded user this opens
304803
+#			automount(8) to potential user privilege
304803
+#			escalation when the program map is written
304803
+#			in a language that  can load components from,
304803
+#			for example, a user home directory.
304803
+#
304803
+# force_standard_program_map_env = no
304803
+#
304803
 # Define base dn for map dn lookup.
304803
 #
304803
 # Define server URIs