|
 |
b1b450 |
From 613a8053dbc3ab43cf0cdaf09f207ffdb0b40e08 Mon Sep 17 00:00:00 2001
|
|
|
b1b450 |
From: Radovan Sroka <rsroka@redhat.com>
|
|
|
b1b450 |
Date: Wed, 7 Apr 2021 14:43:40 +0200
|
|
|
b1b450 |
Subject: [PATCH] Fixed bad condition for sesh args
|
|
|
b1b450 |
|
|
|
b1b450 |
In selinux_edit_copy_tfiles() when there is only one file and the open()
|
|
|
b1b450 |
fails then number of arguments is lower than expected.
|
|
|
b1b450 |
Sudo should return error with or without "Defaults !sudoedit_checkdir" set.
|
|
|
b1b450 |
|
|
|
b1b450 |
This was found with regression testing of CVE-2021-23240.
|
|
|
b1b450 |
|
|
|
b1b450 |
Signed-off-by: Radovan Sroka <rsroka@redhat.com>
|
|
|
b1b450 |
---
|
|
|
b1b450 |
src/sudo_edit.c | 10 ++++++++--
|
|
|
b1b450 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
b1b450 |
|
|
|
b1b450 |
diff --git a/src/sudo_edit.c b/src/sudo_edit.c
|
|
|
b1b450 |
index 41fc61c3a..15c75d8c4 100644
|
|
|
b1b450 |
--- a/src/sudo_edit.c
|
|
|
b1b450 |
+++ b/src/sudo_edit.c
|
|
|
b1b450 |
@@ -529,6 +529,8 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
|
|
|
b1b450 |
if (nfiles < 1)
|
|
|
b1b450 |
debug_return_int(0);
|
|
|
b1b450 |
|
|
|
b1b450 |
+ const int check_dir = ISSET(command_details->flags, CD_SUDOEDIT_CHECKDIR);
|
|
|
b1b450 |
+
|
|
|
b1b450 |
/* Construct common args for sesh */
|
|
|
b1b450 |
sesh_nargs = 5 + (nfiles * 2) + 1;
|
|
|
b1b450 |
sesh_args = sesh_ap = reallocarray(NULL, sesh_nargs, sizeof(char *));
|
|
|
b1b450 |
@@ -538,7 +540,7 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
|
|
|
b1b450 |
}
|
|
|
b1b450 |
*sesh_ap++ = "sesh";
|
|
|
b1b450 |
*sesh_ap++ = "-e";
|
|
|
b1b450 |
- if (ISSET(command_details->flags, CD_SUDOEDIT_CHECKDIR)) {
|
|
|
b1b450 |
+ if (check_dir) {
|
|
|
b1b450 |
if ((user_str = selinux_fmt_sudo_user()) == NULL) {
|
|
|
b1b450 |
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
|
|
|
b1b450 |
goto done;
|
|
|
b1b450 |
@@ -581,7 +583,11 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
|
|
|
b1b450 |
if (tfd != -1)
|
|
|
b1b450 |
close(tfd);
|
|
|
b1b450 |
|
|
|
b1b450 |
- if (sesh_ap - sesh_args > 3) {
|
|
|
b1b450 |
+ /*
|
|
|
b1b450 |
+ * check dir adds two more args to the array
|
|
|
b1b450 |
+ */
|
|
|
b1b450 |
+ if ((!check_dir && sesh_ap - sesh_args > 3)
|
|
|
b1b450 |
+ || (check_dir && sesh_ap - sesh_args > 5)) {
|
|
|
b1b450 |
/* Run sesh -e 1 <t1> <o1> ... <tn> <on> */
|
|
|
b1b450 |
error = selinux_run_helper(command_details->cred.uid, command_details->cred.gid,
|
|
|
b1b450 |
command_details->cred.ngroups, command_details->cred.groups, sesh_args,
|