|
 |
dc3ed5 |
From 8635ffc16aeff6a07d675f861fe0dea03ea81d7e Mon Sep 17 00:00:00 2001
|
|
|
dc3ed5 |
From: Colin Walters <walters@verbum.org>
|
|
|
dc3ed5 |
Date: Thu, 21 Nov 2013 17:39:37 -0500
|
|
|
dc3ed5 |
Subject: [PATCH] pkexec: Work around systemd injecting broken XDG_RUNTIME_DIR
|
|
|
dc3ed5 |
|
|
|
dc3ed5 |
This workaround isn't too much code, and it's often better to fix bugs
|
|
|
dc3ed5 |
in two places anyways.
|
|
|
dc3ed5 |
|
|
|
dc3ed5 |
For more information:
|
|
|
dc3ed5 |
|
|
|
dc3ed5 |
See https://bugzilla.redhat.com/show_bug.cgi?id=753882
|
|
|
dc3ed5 |
See http://lists.freedesktop.org/archives/systemd-devel/2013-November/014370.html
|
|
|
dc3ed5 |
---
|
|
|
dc3ed5 |
src/programs/pkexec.c | 33 ++++++++++++++++++++++++++++++---
|
|
|
dc3ed5 |
1 file changed, 30 insertions(+), 3 deletions(-)
|
|
|
dc3ed5 |
|
|
|
dc3ed5 |
diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c
|
|
|
dc3ed5 |
index 005e1fe..a7ca8e0 100644
|
|
|
dc3ed5 |
--- a/src/programs/pkexec.c
|
|
|
dc3ed5 |
+++ b/src/programs/pkexec.c
|
|
|
dc3ed5 |
@@ -143,8 +143,22 @@ pam_conversation_function (int n,
|
|
|
dc3ed5 |
return PAM_CONV_ERR;
|
|
|
dc3ed5 |
}
|
|
|
dc3ed5 |
|
|
|
dc3ed5 |
+/* A work around for:
|
|
|
dc3ed5 |
+ * https://bugzilla.redhat.com/show_bug.cgi?id=753882
|
|
|
dc3ed5 |
+ */
|
|
|
dc3ed5 |
+static gboolean
|
|
|
dc3ed5 |
+xdg_runtime_dir_is_owned_by (const char *path,
|
|
|
dc3ed5 |
+ uid_t target_uid)
|
|
|
dc3ed5 |
+{
|
|
|
dc3ed5 |
+ struct stat stbuf;
|
|
|
dc3ed5 |
+
|
|
|
dc3ed5 |
+ return stat (path, &stbuf) == 0 &&
|
|
|
dc3ed5 |
+ stbuf.st_uid == target_uid;
|
|
|
dc3ed5 |
+}
|
|
|
dc3ed5 |
+
|
|
|
dc3ed5 |
static gboolean
|
|
|
dc3ed5 |
-open_session (const gchar *user_to_auth)
|
|
|
dc3ed5 |
+open_session (const gchar *user_to_auth,
|
|
|
dc3ed5 |
+ uid_t target_uid)
|
|
|
dc3ed5 |
{
|
|
|
dc3ed5 |
gboolean ret;
|
|
|
dc3ed5 |
gint rc;
|
|
|
dc3ed5 |
@@ -186,7 +200,19 @@ open_session (const gchar *user_to_auth)
|
|
|
dc3ed5 |
{
|
|
|
dc3ed5 |
guint n;
|
|
|
dc3ed5 |
for (n = 0; envlist[n]; n++)
|
|
|
dc3ed5 |
- putenv (envlist[n]);
|
|
|
dc3ed5 |
+ {
|
|
|
dc3ed5 |
+ const char *envitem = envlist[n];
|
|
|
dc3ed5 |
+
|
|
|
dc3ed5 |
+ if (g_str_has_prefix (envitem, "XDG_RUNTIME_DIR="))
|
|
|
dc3ed5 |
+ {
|
|
|
dc3ed5 |
+ const char *eq = strchr (envitem, '=');
|
|
|
dc3ed5 |
+ g_assert (eq);
|
|
|
dc3ed5 |
+ if (!xdg_runtime_dir_is_owned_by (eq + 1, target_uid))
|
|
|
dc3ed5 |
+ continue;
|
|
|
dc3ed5 |
+ }
|
|
|
dc3ed5 |
+
|
|
|
dc3ed5 |
+ putenv (envlist[n]);
|
|
|
dc3ed5 |
+ }
|
|
|
dc3ed5 |
free (envlist);
|
|
|
dc3ed5 |
}
|
|
|
dc3ed5 |
|
|
|
dc3ed5 |
@@ -913,7 +939,8 @@ main (int argc, char *argv[])
|
|
|
dc3ed5 |
* As evident above, neither su(1) (and, for that matter, nor sudo(8)) does this.
|
|
|
dc3ed5 |
*/
|
|
|
dc3ed5 |
#ifdef POLKIT_AUTHFW_PAM
|
|
|
dc3ed5 |
- if (!open_session (pw->pw_name))
|
|
|
dc3ed5 |
+ if (!open_session (pw->pw_name,
|
|
|
dc3ed5 |
+ pw->pw_uid))
|
|
|
dc3ed5 |
{
|
|
|
dc3ed5 |
goto out;
|
|
|
dc3ed5 |
}
|
|
|
dc3ed5 |
--
|
|
|
dc3ed5 |
1.8.3.1
|
|
|
dc3ed5 |
|