valeriyvdovin / rpms / systemd

Forked from rpms/systemd 4 years ago
Clone

Blame SOURCES/0441-basic-fix-touch-creating-files-with-07777-mode.patch

a19bc6
From 616db6ddcacd25e4c3a771cd317373971c9055ed Mon Sep 17 00:00:00 2001
a19bc6
From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= <grawity@gmail.com>
a19bc6
Date: Fri, 29 Jan 2016 23:36:08 +0200
a19bc6
Subject: [PATCH] basic: fix touch() creating files with 07777 mode
a19bc6
a19bc6
mode_t is unsigned, so MODE_INVALID < 0 can never be true.
a19bc6
a19bc6
This fixes a possible DoS where any user could fill /run by writing to
a19bc6
a world-writable /run/systemd/show-status.
a19bc6
a19bc6
Cherry-picked from: 06eeacb6fe029804f296b065b3ce91e796e1cd0e
a19bc6
Resolves: #1416062
a19bc6
---
a19bc6
 src/shared/util.c | 3 ++-
a19bc6
 1 file changed, 2 insertions(+), 1 deletion(-)
a19bc6
a19bc6
diff --git a/src/shared/util.c b/src/shared/util.c
181b3f
index 66729f70e..1070e32c4 100644
a19bc6
--- a/src/shared/util.c
a19bc6
+++ b/src/shared/util.c
a19bc6
@@ -3908,7 +3908,8 @@ int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gi
a19bc6
         if (parents)
a19bc6
                 mkdir_parents(path, 0755);
a19bc6
 
a19bc6
-        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644);
a19bc6
+        fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY,
a19bc6
+                        (mode == 0 || mode == MODE_INVALID) ? 0644 : mode);
a19bc6
         if (fd < 0)
a19bc6
                 return -errno;
a19bc6