|
 |
88f331 |
From a9b7e9e368e79957ef492304bf62742b1304b7bb Mon Sep 17 00:00:00 2001
|
|
|
88f331 |
From: Matthias Clasen <mclasen@redhat.com>
|
|
|
88f331 |
Date: Fri, 1 Nov 2013 17:09:25 -0400
|
|
|
88f331 |
Subject: [PATCH] Avoid deleting the root user
|
|
|
88f331 |
|
|
|
88f331 |
The check we have in place against deleting the root user can
|
|
|
88f331 |
be tricked by exploiting the fact that we are checking a gint64,
|
|
|
88f331 |
and then later cast it to a uid_t. This can be seen with the
|
|
|
88f331 |
following test, which will delete your root account:
|
|
|
88f331 |
|
|
|
88f331 |
qdbus --system org.freedesktop.Accounts /org/freedesktop/Accounts \
|
|
|
88f331 |
org.freedesktop.Accounts.DeleteUser -9223372036854775808 true
|
|
|
88f331 |
|
|
|
88f331 |
Found with the dfuzzer tool,
|
|
|
88f331 |
https://github.com/matusmarhefka/dfuzzer
|
|
|
88f331 |
---
|
|
|
88f331 |
src/daemon.c | 6 +++---
|
|
|
88f331 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
88f331 |
|
|
|
88f331 |
diff --git a/src/daemon.c b/src/daemon.c
|
|
|
88f331 |
index 9c9f617..b2720f4 100644
|
|
|
88f331 |
--- a/src/daemon.c
|
|
|
88f331 |
+++ b/src/daemon.c
|
|
|
88f331 |
@@ -1232,7 +1232,7 @@ daemon_uncache_user (AccountsAccounts *accounts,
|
|
|
88f331 |
}
|
|
|
88f331 |
|
|
|
88f331 |
typedef struct {
|
|
|
88f331 |
- gint64 uid;
|
|
|
88f331 |
+ uid_t uid;
|
|
|
88f331 |
gboolean remove_files;
|
|
|
88f331 |
} DeleteUserData;
|
|
|
88f331 |
|
|
|
88f331 |
@@ -1314,13 +1314,13 @@ daemon_delete_user (AccountsAccounts *accounts,
|
|
|
88f331 |
Daemon *daemon = (Daemon*)accounts;
|
|
|
88f331 |
DeleteUserData *data;
|
|
|
88f331 |
|
|
|
88f331 |
- if (uid == 0) {
|
|
|
88f331 |
+ if ((uid_t)uid == 0) {
|
|
|
88f331 |
throw_error (context, ERROR_FAILED, "Refuse to delete root user");
|
|
|
88f331 |
return TRUE;
|
|
|
88f331 |
}
|
|
|
88f331 |
|
|
|
88f331 |
data = g_new0 (DeleteUserData, 1);
|
|
|
88f331 |
- data->uid = uid;
|
|
|
88f331 |
+ data->uid = (uid_t)uid;
|
|
|
88f331 |
data->remove_files = remove_files;
|
|
|
88f331 |
|
|
|
88f331 |
daemon_local_check_auth (daemon,
|
|
|
88f331 |
--
|
|
|
88f331 |
1.8.4.2
|
|
|
88f331 |
|