|
Jakub Filak |
d596ad |
From d8a3bd0d464f5b75ac360f4ee4e3cc6927a09199 Mon Sep 17 00:00:00 2001
|
|
Jakub Filak |
d596ad |
From: Jakub Filak <jfilak@redhat.com>
|
|
Jakub Filak |
d596ad |
Date: Wed, 30 Sep 2015 14:13:35 +0200
|
|
Jakub Filak |
d596ad |
Subject: [PATCH] lib: add convenient wrappers for ensuring writable dir
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
Replace lchown with fchown and chmod with fchmod.
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
Related CVE-2015-5287
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
Signed-off-by: Jakub Filak <jfilak@redhat.com>
|
|
Jakub Filak |
d596ad |
---
|
|
Jakub Filak |
d596ad |
src/include/libabrt.h | 4 ++++
|
|
Jakub Filak |
d596ad |
src/lib/hooklib.c | 41 ++++++++++++++++++++++++++++++++++-------
|
|
Jakub Filak |
d596ad |
2 files changed, 38 insertions(+), 7 deletions(-)
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
diff --git a/src/include/libabrt.h b/src/include/libabrt.h
|
|
Jakub Filak |
d596ad |
index 6f89959..b26dcc6 100644
|
|
Jakub Filak |
d596ad |
--- a/src/include/libabrt.h
|
|
Jakub Filak |
d596ad |
+++ b/src/include/libabrt.h
|
|
Jakub Filak |
d596ad |
@@ -42,8 +42,12 @@ int low_free_space(unsigned setting_MaxCrashReportsSize, const char *dump_locati
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
#define trim_problem_dirs abrt_trim_problem_dirs
|
|
Jakub Filak |
d596ad |
void trim_problem_dirs(const char *dirname, double cap_size, const char *exclude_path);
|
|
Jakub Filak |
d596ad |
+#define ensure_writable_dir_id abrt_ensure_writable_dir_uid_git
|
|
Jakub Filak |
d596ad |
+void ensure_writable_dir_uid_gid(const char *dir, mode_t mode, uid_t uid, gid_t gid);
|
|
Jakub Filak |
d596ad |
#define ensure_writable_dir abrt_ensure_writable_dir
|
|
Jakub Filak |
d596ad |
void ensure_writable_dir(const char *dir, mode_t mode, const char *user);
|
|
Jakub Filak |
d596ad |
+#define ensure_writable_dir_group abrt_ensure_writable_dir_group
|
|
Jakub Filak |
d596ad |
+void ensure_writable_dir_group(const char *dir, mode_t mode, const char *user, const char *group);
|
|
Jakub Filak |
d596ad |
#define run_unstrip_n abrt_run_unstrip_n
|
|
Jakub Filak |
d596ad |
char *run_unstrip_n(const char *dump_dir_name, unsigned timeout_sec);
|
|
Jakub Filak |
d596ad |
#define get_backtrace abrt_get_backtrace
|
|
Jakub Filak |
d596ad |
diff --git a/src/lib/hooklib.c b/src/lib/hooklib.c
|
|
Jakub Filak |
d596ad |
index 2b76eea..0daa144 100644
|
|
Jakub Filak |
d596ad |
--- a/src/lib/hooklib.c
|
|
Jakub Filak |
d596ad |
+++ b/src/lib/hooklib.c
|
|
Jakub Filak |
d596ad |
@@ -476,23 +476,50 @@ int signal_is_fatal(int signal_no, const char **name)
|
|
Jakub Filak |
d596ad |
return signame != NULL;
|
|
Jakub Filak |
d596ad |
}
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
-void ensure_writable_dir(const char *dir, mode_t mode, const char *user)
|
|
Jakub Filak |
d596ad |
+void ensure_writable_dir_uid_gid(const char *dir, mode_t mode, uid_t uid, gid_t gid)
|
|
Jakub Filak |
d596ad |
{
|
|
Jakub Filak |
d596ad |
struct stat sb;
|
|
Jakub Filak |
d596ad |
+ int dir_fd;
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
if (mkdir(dir, mode) != 0 && errno != EEXIST)
|
|
Jakub Filak |
d596ad |
perror_msg_and_die("Can't create '%s'", dir);
|
|
Jakub Filak |
d596ad |
- if (stat(dir, &sb) != 0 || !S_ISDIR(sb.st_mode))
|
|
Jakub Filak |
d596ad |
- error_msg_and_die("'%s' is not a directory", dir);
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
+ dir_fd = open(dir, O_DIRECTORY | O_NOFOLLOW);
|
|
Jakub Filak |
d596ad |
+ if (dir_fd < 0)
|
|
Jakub Filak |
d596ad |
+ perror_msg_and_die("Can't open directory '%s'", dir);
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+ if (fstat(dir_fd, &sb) != 0)
|
|
Jakub Filak |
d596ad |
+ perror_msg_and_die("Can't stat directory '%s'", dir);
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+ if ((sb.st_uid != uid || sb.st_gid != gid) && fchown(dir_fd, uid, gid) != 0)
|
|
Jakub Filak |
d596ad |
+ perror_msg_and_die("Can't set owner %u:%u on '%s'", (unsigned int)uid, (unsigned int)gid, dir);
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+ if ((sb.st_mode & 07777) != mode && fchmod(dir_fd, mode) != 0)
|
|
Jakub Filak |
d596ad |
+ perror_msg_and_die("Can't set mode %o on '%s'", mode, dir);
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+ close(dir_fd);
|
|
Jakub Filak |
d596ad |
+}
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+void ensure_writable_dir(const char *dir, mode_t mode, const char *user)
|
|
Jakub Filak |
d596ad |
+{
|
|
Jakub Filak |
d596ad |
+ struct passwd *pw = getpwnam(user);
|
|
Jakub Filak |
d596ad |
+ if (!pw)
|
|
Jakub Filak |
d596ad |
+ perror_msg_and_die("Can't find user '%s'", user);
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+ ensure_writable_dir_uid_gid(dir, mode, pw->pw_uid, pw->pw_gid);
|
|
Jakub Filak |
d596ad |
+}
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+void ensure_writable_dir_group(const char *dir, mode_t mode, const char *user, const char *group)
|
|
Jakub Filak |
d596ad |
+{
|
|
Jakub Filak |
d596ad |
struct passwd *pw = getpwnam(user);
|
|
Jakub Filak |
d596ad |
if (!pw)
|
|
Jakub Filak |
d596ad |
perror_msg_and_die("Can't find user '%s'", user);
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
- if ((sb.st_uid != pw->pw_uid || sb.st_gid != pw->pw_gid) && lchown(dir, pw->pw_uid, pw->pw_gid) != 0)
|
|
Jakub Filak |
d596ad |
- perror_msg_and_die("Can't set owner %u:%u on '%s'", (unsigned int)pw->pw_uid, (unsigned int)pw->pw_gid, dir);
|
|
Jakub Filak |
d596ad |
- if ((sb.st_mode & 07777) != mode && chmod(dir, mode) != 0)
|
|
Jakub Filak |
d596ad |
- perror_msg_and_die("Can't set mode %o on '%s'", mode, dir);
|
|
Jakub Filak |
d596ad |
+ struct group *gr = getgrnam(group);
|
|
Jakub Filak |
d596ad |
+ if (!gr)
|
|
Jakub Filak |
d596ad |
+ perror_msg_and_die("Can't find group '%s'", group);
|
|
Jakub Filak |
d596ad |
+
|
|
Jakub Filak |
d596ad |
+ ensure_writable_dir_uid_gid(dir, mode, pw->pw_uid, gr->gr_gid);
|
|
Jakub Filak |
d596ad |
}
|
|
Jakub Filak |
d596ad |
|
|
Jakub Filak |
d596ad |
bool dir_is_in_dump_location(const char *dir_name)
|
|
Jakub Filak |
d596ad |
--
|
|
Jakub Filak |
d596ad |
2.6.3
|
|
Jakub Filak |
d596ad |
|