|
 |
6402e1 |
From ec0e724fe53188c5c762c34ca9db6681c0de01b8 Mon Sep 17 00:00:00 2001
|
|
|
6402e1 |
From: Iker Pedrosa <ipedrosa@redhat.com>
|
|
|
6402e1 |
Date: Thu, 1 Jul 2021 12:14:29 +0200
|
|
|
6402e1 |
Subject: [PATCH] pam_filter: Close file after controlling tty
|
|
|
6402e1 |
|
|
|
6402e1 |
Failing to check the descriptor value meant that there was a bug in the
|
|
|
6402e1 |
attempt to close the controlling tty. Moreover, this would lead to a
|
|
|
6402e1 |
file descriptor leak as pointed out by the static analyzer tool:
|
|
|
6402e1 |
|
|
|
6402e1 |
Error: RESOURCE_LEAK (CWE-772): [#def26]
|
|
|
6402e1 |
Linux-PAM-1.5.1/modules/pam_filter/pam_filter.c:356: open_fn: Returning handle opened by "open". [Note: The source code implementation of the function has been overridden by a user model.]
|
|
|
6402e1 |
Linux-PAM-1.5.1/modules/pam_filter/pam_filter.c:356: var_assign: Assigning: "t" = handle returned from "open("/dev/tty", 2)".
|
|
|
6402e1 |
Linux-PAM-1.5.1/modules/pam_filter/pam_filter.c:357: off_by_one: Testing whether handle "t" is strictly greater than zero is suspicious. "t" leaks when it is zero.
|
|
|
6402e1 |
Linux-PAM-1.5.1/modules/pam_filter/pam_filter.c:357: remediation: Did you intend to include equality with zero?
|
|
|
6402e1 |
Linux-PAM-1.5.1/modules/pam_filter/pam_filter.c:367: leaked_handle: Handle variable "t" going out of scope leaks the handle.
|
|
|
6402e1 |
365| pam_syslog(pamh, LOG_ERR,
|
|
|
6402e1 |
366| "child cannot become new session: %m");
|
|
|
6402e1 |
367|-> return PAM_ABORT;
|
|
|
6402e1 |
368| }
|
|
|
6402e1 |
369|
|
|
|
6402e1 |
|
|
|
6402e1 |
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
|
|
|
6402e1 |
---
|
|
|
6402e1 |
modules/pam_filter/pam_filter.c | 2 +-
|
|
|
6402e1 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
6402e1 |
|
|
|
6402e1 |
diff --git a/modules/pam_filter/pam_filter.c b/modules/pam_filter/pam_filter.c
|
|
|
6402e1 |
index 2f0af4fb..6e6def37 100644
|
|
|
6402e1 |
--- a/modules/pam_filter/pam_filter.c
|
|
|
6402e1 |
+++ b/modules/pam_filter/pam_filter.c
|
|
|
6402e1 |
@@ -354,7 +354,7 @@ set_filter (pam_handle_t *pamh, int flags UNUSED, int ctrl,
|
|
|
6402e1 |
int t = open("/dev/tty", O_RDWR|O_NOCTTY);
|
|
|
6402e1 |
#else
|
|
|
6402e1 |
int t = open("/dev/tty",O_RDWR);
|
|
|
6402e1 |
- if (t > 0) {
|
|
|
6402e1 |
+ if (t >= 0) {
|
|
|
6402e1 |
(void) ioctl(t, TIOCNOTTY, NULL);
|
|
|
6402e1 |
close(t);
|
|
|
6402e1 |
}
|
|
|
6402e1 |
--
|
|
|
6402e1 |
2.31.1
|
|
|
6402e1 |
|