doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0120-a-a-i-d-t-a-cache-don-t-open-the-build_ids-file-as-a.patch

8ec399
From 3bdf6305f6a8501a692e1a98f98e0be9d3922a1d Mon Sep 17 00:00:00 2001
8ec399
From: Jakub Filak <jfilak@redhat.com>
8ec399
Date: Wed, 20 May 2015 08:08:58 +0200
8ec399
Subject: [ABRT PATCH] a-a-i-d-t-a-cache: don't open the build_ids file as abrt
8ec399
8ec399
Opening the build_ids file as abrt may lead to information disclosure.
8ec399
8ec399
Related: #1216962
8ec399
8ec399
Signed-off-by: Jakub Filak <jfilak@redhat.com>
8ec399
---
8ec399
 .../abrt-action-install-debuginfo-to-abrt-cache.c  | 30 +++++++++++++++++-----
8ec399
 1 file changed, 23 insertions(+), 7 deletions(-)
8ec399
8ec399
diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
8ec399
index cd9ee7a..fafb0c4 100644
8ec399
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
8ec399
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
8ec399
@@ -72,6 +72,11 @@ int main(int argc, char **argv)
8ec399
     };
8ec399
     const unsigned opts = parse_opts(argc, argv, program_options, program_usage_string);
8ec399
 
8ec399
+    const gid_t egid = getegid();
8ec399
+    const gid_t rgid = getgid();
8ec399
+    const uid_t euid = geteuid();
8ec399
+    const gid_t ruid = getuid();
8ec399
+
8ec399
     /* We need to open the build ids file under the caller's UID/GID to avoid
8ec399
      * information disclosures when reading files with changed UID.
8ec399
      * Unfortunately, we cannot replace STDIN with the new fd because ABRT uses
8ec399
@@ -82,7 +87,20 @@ int main(int argc, char **argv)
8ec399
     char *build_ids_self_fd = NULL;
8ec399
     if (strcmp("-", build_ids) != 0)
8ec399
     {
8ec399
+        if (setregid(egid, rgid) < 0)
8ec399
+            perror_msg_and_die("setregid(egid, rgid)");
8ec399
+
8ec399
+        if (setreuid(euid, ruid) < 0)
8ec399
+            perror_msg_and_die("setreuid(euid, ruid)");
8ec399
+
8ec399
         const int build_ids_fd = open(build_ids, O_RDONLY);
8ec399
+
8ec399
+        if (setregid(rgid, egid) < 0)
8ec399
+            perror_msg_and_die("setregid(rgid, egid)");
8ec399
+
8ec399
+        if (setreuid(ruid, euid) < 0 )
8ec399
+            perror_msg_and_die("setreuid(ruid, euid)");
8ec399
+
8ec399
         if (build_ids_fd < 0)
8ec399
             perror_msg_and_die("Failed to open file '%s'", build_ids);
8ec399
 
8ec399
@@ -118,14 +136,12 @@ int main(int argc, char **argv)
8ec399
     /* Switch real user/group to effective ones.
8ec399
      * Otherwise yum library gets confused - gets EPERM (why??).
8ec399
      */
8ec399
-    gid_t g = getegid();
8ec399
     /* do setregid only if we have to, to not upset selinux needlessly */
8ec399
-    if (g != getgid())
8ec399
-        IGNORE_RESULT(setregid(g, g));
8ec399
-    uid_t u = geteuid();
8ec399
-    if (u != getuid())
8ec399
+    if (egid != rgid)
8ec399
+        IGNORE_RESULT(setregid(egid, egid));
8ec399
+    if (euid != ruid)
8ec399
     {
8ec399
-        IGNORE_RESULT(setreuid(u, u));
8ec399
+        IGNORE_RESULT(setreuid(euid, euid));
8ec399
         /* We are suid'ed! */
8ec399
         /* Prevent malicious user from messing up with suid'ed process: */
8ec399
 #if 1
8ec399
@@ -179,7 +195,7 @@ int main(int argc, char **argv)
8ec399
         // abrt-action-install-debuginfo doesn't fail when spawning
8ec399
         // abrt-action-trim-files
8ec399
         char path_env[] = "PATH=/usr/sbin:/sbin:/usr/bin:/bin:"BIN_DIR":"SBIN_DIR;
8ec399
-        if (u != 0)
8ec399
+        if (euid != 0)
8ec399
             strcpy(path_env, "PATH=/usr/bin:/bin:"BIN_DIR);
8ec399
         putenv(path_env);
8ec399
 
8ec399
-- 
8ec399
1.8.3.1
8ec399