100 lines
4.0 KiB
Diff
100 lines
4.0 KiB
Diff
|
From 0966d7fd6e3d51fc99088de94343212c5f09e74d Mon Sep 17 00:00:00 2001
|
||
|
|
From: =?UTF-8?q?Miroslav=20Such=C3=BD?= <msuchy@redhat.com>
|
||
|
|
Date: Tue, 5 May 2020 18:28:50 +0200
|
||
|
|
Subject: [PATCH] setgid instead of setuid the
|
||
|
|
abrt-action-install-debuginfo-to-abrt-cache [RHBZ 1796245]
|
||
|
|
|
||
|
|
OpenSCAP does not like setuid files, we can be setgid instead.
|
||
|
|
|
||
|
|
We need to g+w the directories so other run under a different user can be able to write there too.
|
||
|
|
|
||
|
|
Resolves:
|
||
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1796245
|
||
|
|
---
|
||
|
|
abrt.spec.in | 4 ++--
|
||
|
|
.../abrt-action-install-debuginfo-to-abrt-cache.c | 15 +++------------
|
||
|
|
src/plugins/abrt-action-install-debuginfo.in | 6 ++++++
|
||
|
|
3 files changed, 11 insertions(+), 14 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/abrt.spec.in b/abrt.spec.in
|
||
|
|
index 326294008..4c01fffe6 100644
|
||
|
|
--- a/abrt.spec.in
|
||
|
|
+++ b/abrt.spec.in
|
||
|
|
@@ -1015,8 +1015,8 @@ killall abrt-dbus >/dev/null 2>&1 || :
|
||
|
|
|
||
|
|
%dir %{_localstatedir}/lib/abrt
|
||
|
|
|
||
|
|
-# attr(6755) ~= SETUID|SETGID
|
||
|
|
-%attr(6755, abrt, abrt) %{_libexecdir}/abrt-action-install-debuginfo-to-abrt-cache
|
||
|
|
+# attr(2755) ~= SETGID
|
||
|
|
+%attr(2755, abrt, abrt) %{_libexecdir}/abrt-action-install-debuginfo-to-abrt-cache
|
||
|
|
|
||
|
|
%{_bindir}/abrt-action-analyze-c
|
||
|
|
%{_bindir}/abrt-action-trim-files
|
||
|
|
diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
|
||
|
|
index 71967f77a..0f843512e 100644
|
||
|
|
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
|
||
|
|
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
|
||
|
|
@@ -78,7 +78,6 @@ int main(int argc, char **argv)
|
||
|
|
const gid_t egid = getegid();
|
||
|
|
const gid_t rgid = getgid();
|
||
|
|
const uid_t euid = geteuid();
|
||
|
|
- const gid_t ruid = getuid();
|
||
|
|
|
||
|
|
/* We need to open the build ids file under the caller's UID/GID to avoid
|
||
|
|
* information disclosures when reading files with changed UID.
|
||
|
|
@@ -93,17 +92,11 @@ int main(int argc, char **argv)
|
||
|
|
if (setregid(egid, rgid) < 0)
|
||
|
|
perror_msg_and_die("setregid(egid, rgid)");
|
||
|
|
|
||
|
|
- if (setreuid(euid, ruid) < 0)
|
||
|
|
- perror_msg_and_die("setreuid(euid, ruid)");
|
||
|
|
-
|
||
|
|
const int build_ids_fd = open(build_ids, O_RDONLY);
|
||
|
|
|
||
|
|
if (setregid(rgid, egid) < 0)
|
||
|
|
perror_msg_and_die("setregid(rgid, egid)");
|
||
|
|
|
||
|
|
- if (setreuid(ruid, euid) < 0 )
|
||
|
|
- perror_msg_and_die("setreuid(ruid, euid)");
|
||
|
|
-
|
||
|
|
if (build_ids_fd < 0)
|
||
|
|
perror_msg_and_die("Failed to open file '%s'", build_ids);
|
||
|
|
|
||
|
|
@@ -155,12 +148,10 @@ int main(int argc, char **argv)
|
||
|
|
*/
|
||
|
|
/* do setregid only if we have to, to not upset selinux needlessly */
|
||
|
|
if (egid != rgid)
|
||
|
|
- IGNORE_RESULT(setregid(egid, egid));
|
||
|
|
- if (euid != ruid)
|
||
|
|
{
|
||
|
|
- IGNORE_RESULT(setreuid(euid, euid));
|
||
|
|
- /* We are suid'ed! */
|
||
|
|
- /* Prevent malicious user from messing up with suid'ed process: */
|
||
|
|
+ IGNORE_RESULT(setregid(egid, egid));
|
||
|
|
+ /* We are sgid'ed! */
|
||
|
|
+ /* Prevent malicious user from messing up with sgid'ed process: */
|
||
|
|
#if 1
|
||
|
|
// We forgot to sanitize PYTHONPATH. And who knows what else we forgot
|
||
|
|
// (especially considering *future* new variables of this kind).
|
||
|
|
diff --git a/src/plugins/abrt-action-install-debuginfo.in b/src/plugins/abrt-action-install-debuginfo.in
|
||
|
|
index 6269c221e..659a9aa84 100644
|
||
|
|
--- a/src/plugins/abrt-action-install-debuginfo.in
|
||
|
|
+++ b/src/plugins/abrt-action-install-debuginfo.in
|
||
|
|
@@ -248,6 +248,12 @@ if __name__ == "__main__":
|
||
|
|
repo_pattern=repo_pattern,
|
||
|
|
releasever=releasever)
|
||
|
|
result = downloader.download(missing, download_exact_files=exact_fls)
|
||
|
|
+
|
||
|
|
+ # make sure that all downloaded directories are writeable by abrt group
|
||
|
|
+ for root, dirs, files in os.walk(self.cachedirs[0]):
|
||
|
|
+ for walked_dir in dirs:
|
||
|
|
+ os.chmod(os.path.join(root, walked_dir), 0o775)
|
||
|
|
+
|
||
|
|
except OSError as ex:
|
||
|
|
if ex.errno == errno.EPIPE:
|
||
|
|
clean_up(TMPDIR, silent=True)
|
||
|
|
--
|
||
|
|
2.21.3
|
||
|
|
|