fapolicyd/SOURCES/fapolicyd-deleted-suffix.patch
2021-09-09 16:30:37 +00:00

50 lines
1.1 KiB
Diff

From 8b7ea120670525d9ac7f1698ae7482d691e840a4 Mon Sep 17 00:00:00 2001
From: Radovan Sroka <rsroka@redhat.com>
Date: Mon, 9 Nov 2020 17:02:22 +0100
Subject: [PATCH] Added check for " (deleted)" suffix in get_program_from_fd()
(#97)
- get rid of this suffix
Signed-off-by: Radovan Sroka <rsroka@redhat.com>
Removed strstr (#102)
---
src/library/process.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/src/library/process.c b/src/library/process.c
index edd2cca..6406610 100644
--- a/src/library/process.c
+++ b/src/library/process.c
@@ -146,10 +146,24 @@ char *get_program_from_pid(pid_t pid, size_t blen, char *buf)
return buf;
}
+
+ size_t len = 0;
if ((size_t)path_len < blen)
- buf[path_len] = 0;
+ len = path_len;
else
- buf[blen-1] = '\0';
+ len = blen-1;
+
+ buf[len] = '\0';
+ // some binaries can be deleted after execution
+ // then we need to delete the suffix so they are
+ // trusted even after deletion
+
+ // strlen(" deleted") == 10
+ if (buf[len-1] == ')' && len > 10) {
+
+ if (strcmp(&buf[len - 10], " (deleted)") == 0)
+ buf[len - 10] = '\0';
+ }
return buf;
}
--
2.26.2