abrt/SOURCES/0082-setgid-instead-of-setuid-the-abrt-action-install-deb.patch
2021-10-08 09:39:04 +00:00

100 lines
4.0 KiB
Diff

From 0966d7fd6e3d51fc99088de94343212c5f09e74d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miroslav=20Such=C3=BD?= <msuchy@redhat.com>
Date: Tue, 5 May 2020 18:28:50 +0200
Subject: [PATCH] setgid instead of setuid the
abrt-action-install-debuginfo-to-abrt-cache [RHBZ 1796245]
OpenSCAP does not like setuid files, we can be setgid instead.
We need to g+w the directories so other run under a different user can be able to write there too.
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1796245
---
abrt.spec.in | 4 ++--
.../abrt-action-install-debuginfo-to-abrt-cache.c | 15 +++------------
src/plugins/abrt-action-install-debuginfo.in | 6 ++++++
3 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/abrt.spec.in b/abrt.spec.in
index 326294008..4c01fffe6 100644
--- a/abrt.spec.in
+++ b/abrt.spec.in
@@ -1015,8 +1015,8 @@ killall abrt-dbus >/dev/null 2>&1 || :
%dir %{_localstatedir}/lib/abrt
-# attr(6755) ~= SETUID|SETGID
-%attr(6755, abrt, abrt) %{_libexecdir}/abrt-action-install-debuginfo-to-abrt-cache
+# attr(2755) ~= SETGID
+%attr(2755, abrt, abrt) %{_libexecdir}/abrt-action-install-debuginfo-to-abrt-cache
%{_bindir}/abrt-action-analyze-c
%{_bindir}/abrt-action-trim-files
diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
index 71967f77a..0f843512e 100644
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
@@ -78,7 +78,6 @@ int main(int argc, char **argv)
const gid_t egid = getegid();
const gid_t rgid = getgid();
const uid_t euid = geteuid();
- const gid_t ruid = getuid();
/* We need to open the build ids file under the caller's UID/GID to avoid
* information disclosures when reading files with changed UID.
@@ -93,17 +92,11 @@ int main(int argc, char **argv)
if (setregid(egid, rgid) < 0)
perror_msg_and_die("setregid(egid, rgid)");
- if (setreuid(euid, ruid) < 0)
- perror_msg_and_die("setreuid(euid, ruid)");
-
const int build_ids_fd = open(build_ids, O_RDONLY);
if (setregid(rgid, egid) < 0)
perror_msg_and_die("setregid(rgid, egid)");
- if (setreuid(ruid, euid) < 0 )
- perror_msg_and_die("setreuid(ruid, euid)");
-
if (build_ids_fd < 0)
perror_msg_and_die("Failed to open file '%s'", build_ids);
@@ -155,12 +148,10 @@ int main(int argc, char **argv)
*/
/* do setregid only if we have to, to not upset selinux needlessly */
if (egid != rgid)
- IGNORE_RESULT(setregid(egid, egid));
- if (euid != ruid)
{
- IGNORE_RESULT(setreuid(euid, euid));
- /* We are suid'ed! */
- /* Prevent malicious user from messing up with suid'ed process: */
+ IGNORE_RESULT(setregid(egid, egid));
+ /* We are sgid'ed! */
+ /* Prevent malicious user from messing up with sgid'ed process: */
#if 1
// We forgot to sanitize PYTHONPATH. And who knows what else we forgot
// (especially considering *future* new variables of this kind).
diff --git a/src/plugins/abrt-action-install-debuginfo.in b/src/plugins/abrt-action-install-debuginfo.in
index 6269c221e..659a9aa84 100644
--- a/src/plugins/abrt-action-install-debuginfo.in
+++ b/src/plugins/abrt-action-install-debuginfo.in
@@ -248,6 +248,12 @@ if __name__ == "__main__":
repo_pattern=repo_pattern,
releasever=releasever)
result = downloader.download(missing, download_exact_files=exact_fls)
+
+ # make sure that all downloaded directories are writeable by abrt group
+ for root, dirs, files in os.walk(self.cachedirs[0]):
+ for walked_dir in dirs:
+ os.chmod(os.path.join(root, walked_dir), 0o775)
+
except OSError as ex:
if ex.errno == errno.EPIPE:
clean_up(TMPDIR, silent=True)
--
2.21.3