doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0097-ccpp-harden-dealing-with-UID-GID.patch

baab13
From b72616471ec52a009904689592f4f69e730a6f56 Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Fri, 17 Apr 2015 14:42:13 +0200
baab13
Subject: [ABRT PATCH] ccpp: harden dealing with UID/GID
baab13
baab13
* Don't fall back to UID 0.
baab13
* Use fsgid.
baab13
baab13
This issue was discovered by Florian Weimer of Red Hat Product Security.
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
---
baab13
 src/hooks/abrt-hook-ccpp.c | 39 ++++++++++++++++++++++++++-------------
baab13
 1 file changed, 26 insertions(+), 13 deletions(-)
baab13
baab13
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
baab13
index d600bb7..d9f1f5e 100644
baab13
--- a/src/hooks/abrt-hook-ccpp.c
baab13
+++ b/src/hooks/abrt-hook-ccpp.c
baab13
@@ -218,23 +218,27 @@ static char* get_rootdir(pid_t pid)
baab13
     return malloc_readlink(buf);
baab13
 }
baab13
 
baab13
-static int get_fsuid(void)
baab13
+static int get_proc_fs_id(char type)
baab13
 {
baab13
-    int real, euid, saved;
baab13
-    /* if we fail to parse the uid, then make it root only readable to be safe */
baab13
-    int fs_uid = 0;
baab13
+    const char *scanf_format = "%*cid:\t%d\t%d\t%d\t%d\n";
baab13
+    char id_type[] = "_id";
baab13
+    id_type[0] = type;
baab13
+
baab13
+    int real, e_id, saved;
baab13
+    int fs_id = 0;
baab13
 
baab13
     char *line = proc_pid_status; /* never NULL */
baab13
     for (;;)
baab13
     {
baab13
-        if (strncmp(line, "Uid", 3) == 0)
baab13
+        if (strncmp(line, id_type, 3) == 0)
baab13
         {
baab13
-            int n = sscanf(line, "Uid:\t%d\t%d\t%d\t%d\n", &real, &euid, &saved, &fs_uid);
baab13
+            int n = sscanf(line, scanf_format, &real, &e_id, &saved, &fs_id);
baab13
             if (n != 4)
baab13
             {
baab13
-                perror_msg_and_die("Can't parse Uid: line");
baab13
+                perror_msg_and_die("Can't parse %cid: line", type);
baab13
             }
baab13
-            break;
baab13
+
baab13
+            return fs_id;
baab13
         }
baab13
         line = strchr(line, '\n');
baab13
         if (!line)
baab13
@@ -242,7 +246,17 @@ static int get_fsuid(void)
baab13
         line++;
baab13
     }
baab13
 
baab13
-    return fs_uid;
baab13
+    perror_msg_and_die("Failed to get file system %cID of the crashed process", type);
baab13
+}
baab13
+
baab13
+static int get_fsuid(void)
baab13
+{
baab13
+    return get_proc_fs_id(/*UID*/'U');
baab13
+}
baab13
+
baab13
+static int get_fsgid(void)
baab13
+{
baab13
+    return get_proc_fs_id(/*GID*/'G');
baab13
 }
baab13
 
baab13
 static int dump_suid_policy()
baab13
@@ -278,10 +292,9 @@ static int open_user_core(uid_t uid, uid_t fsuid, pid_t pid, char **percent_valu
baab13
     if (proc_cwd == NULL)
baab13
         return -1;
baab13
 
baab13
-    struct passwd* pw = getpwuid(uid);
baab13
-    gid_t gid = pw ? pw->pw_gid : uid;
baab13
-    //log("setting uid: %i gid: %i", uid, gid);
baab13
-    xsetegid(gid);
baab13
+    errno = 0;
baab13
+
baab13
+    xsetegid(get_fsgid());
baab13
     xseteuid(fsuid);
baab13
 
baab13
     if (strcmp(core_basename, "core") == 0)
baab13
-- 
baab13
1.8.3.1
baab13