|
 |
98d1c9 |
From bbda272145ebbe0cbb65467c1573e583b9e1b7c7 Mon Sep 17 00:00:00 2001
|
|
|
98d1c9 |
From: Robbie Harwood <rharwood@redhat.com>
|
|
|
98d1c9 |
Date: Fri, 3 Jun 2016 14:30:36 +0000
|
|
|
98d1c9 |
Subject: [PATCH] Use new socket if uid, pid, or gid changes
|
|
|
98d1c9 |
|
|
|
98d1c9 |
The gssproxy daemon uses SO_PEERCRED to determine credentials of the
|
|
|
98d1c9 |
connecting process. However, these credentials are set only at the time
|
|
|
98d1c9 |
connect has called. Therefore they must be reset every time uid or pid
|
|
|
98d1c9 |
changes. For completeness, we check gid as well.
|
|
|
98d1c9 |
|
|
|
98d1c9 |
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
|
|
|
98d1c9 |
Reviewed-by: Simo Sorce <simo@redhat.com>
|
|
|
98d1c9 |
Closes #27
|
|
|
98d1c9 |
---
|
|
|
98d1c9 |
proxy/src/client/gpm_common.c | 22 ++++++++++++++++++++++
|
|
|
98d1c9 |
1 file changed, 22 insertions(+)
|
|
|
98d1c9 |
|
|
|
98d1c9 |
diff --git a/proxy/src/client/gpm_common.c b/proxy/src/client/gpm_common.c
|
|
|
98d1c9 |
index cb4ccdb..0a54dbc 100644
|
|
|
98d1c9 |
--- a/proxy/src/client/gpm_common.c
|
|
|
98d1c9 |
+++ b/proxy/src/client/gpm_common.c
|
|
|
98d1c9 |
@@ -13,6 +13,12 @@
|
|
|
98d1c9 |
struct gpm_ctx {
|
|
|
98d1c9 |
pthread_mutex_t lock;
|
|
|
98d1c9 |
int fd;
|
|
|
98d1c9 |
+
|
|
|
98d1c9 |
+ /* these are only meaningful if fd != -1 */
|
|
|
98d1c9 |
+ pid_t pid;
|
|
|
98d1c9 |
+ uid_t uid;
|
|
|
98d1c9 |
+ gid_t gid;
|
|
|
98d1c9 |
+
|
|
|
98d1c9 |
int next_xid;
|
|
|
98d1c9 |
};
|
|
|
98d1c9 |
|
|
|
98d1c9 |
@@ -93,6 +99,9 @@ done:
|
|
|
98d1c9 |
}
|
|
|
98d1c9 |
}
|
|
|
98d1c9 |
gpmctx->fd = fd;
|
|
|
98d1c9 |
+ gpmctx->pid = getpid();
|
|
|
98d1c9 |
+ gpmctx->uid = geteuid();
|
|
|
98d1c9 |
+ gpmctx->gid = getegid();
|
|
|
98d1c9 |
return ret;
|
|
|
98d1c9 |
}
|
|
|
98d1c9 |
|
|
|
98d1c9 |
@@ -120,12 +129,25 @@ static void gpm_close_socket(struct gpm_ctx *gpmctx)
|
|
|
98d1c9 |
static int gpm_grab_sock(struct gpm_ctx *gpmctx)
|
|
|
98d1c9 |
{
|
|
|
98d1c9 |
int ret;
|
|
|
98d1c9 |
+ pid_t p;
|
|
|
98d1c9 |
+ uid_t u;
|
|
|
98d1c9 |
+ gid_t g;
|
|
|
98d1c9 |
|
|
|
98d1c9 |
ret = pthread_mutex_lock(&gpmctx->lock);
|
|
|
98d1c9 |
if (ret) {
|
|
|
98d1c9 |
return ret;
|
|
|
98d1c9 |
}
|
|
|
98d1c9 |
|
|
|
98d1c9 |
+ /* Detect fork / setresuid and friends */
|
|
|
98d1c9 |
+ p = getpid();
|
|
|
98d1c9 |
+ u = geteuid();
|
|
|
98d1c9 |
+ g = getegid();
|
|
|
98d1c9 |
+
|
|
|
98d1c9 |
+ if (gpmctx->fd != -1 &&
|
|
|
98d1c9 |
+ (p != gpmctx->pid || u != gpmctx->uid || g != gpmctx->gid)) {
|
|
|
98d1c9 |
+ gpm_close_socket(gpmctx);
|
|
|
98d1c9 |
+ }
|
|
|
98d1c9 |
+
|
|
|
98d1c9 |
if (gpmctx->fd == -1) {
|
|
|
98d1c9 |
ret = gpm_open_socket(gpmctx);
|
|
|
98d1c9 |
}
|
|
|
98d1c9 |
--
|
|
|
98d1c9 |
2.8.1
|
|
|
98d1c9 |
|