[zypp-commit] r7335 - in /branches/SuSE-Linux-10_2-Branch/zypper: package/zypper.changes src/zypp-checkpatches-wrapper.c

Author: aschnell Date: Mon Sep 24 09:57:06 2007 New Revision: 7335 URL: http://svn.opensuse.org/viewcvs/zypp?rev=7335&view=rev Log: - close file-descriptors > 2, call setgid and umask and check file-descriptors 0, 1 and 2 in zypp-checkpatches-wrapper (bug #325556) Modified: branches/SuSE-Linux-10_2-Branch/zypper/package/zypper.changes branches/SuSE-Linux-10_2-Branch/zypper/src/zypp-checkpatches-wrapper.c Modified: branches/SuSE-Linux-10_2-Branch/zypper/package/zypper.changes URL: http://svn.opensuse.org/viewcvs/zypp/branches/SuSE-Linux-10_2-Branch/zypper/package/zypper.changes?rev=7335&r1=7334&r2=7335&view=diff ============================================================================== --- branches/SuSE-Linux-10_2-Branch/zypper/package/zypper.changes (original) +++ branches/SuSE-Linux-10_2-Branch/zypper/package/zypper.changes Mon Sep 24 09:57:06 2007 @@ -1,4 +1,11 @@ ------------------------------------------------------------------- +Thu Sep 20 15:37:46 CEST 2007 - aschnell@suse.de + +- close file-descriptors > 2, call setgid and umask and check + file-descriptors 0, 1 and 2 in zypp-checkpatches-wrapper (bug + #325556) + +------------------------------------------------------------------- Mon Sep 17 13:49:18 CEST 2007 - jkupec@suse.cz - ignore the ZYpp lock if ZYPP_READONLY_HACK=1 env. var. is set @@ -163,7 +170,7 @@ - Show a better message when we can't acquire the lock (#227073) -- r4814 +- r4814 ------------------------------------------------------------------- Mon Dec 18 15:30:49 CET 2006 - dmacvicar@suse.de @@ -171,7 +178,7 @@ - report error if no update sources are configured (#226067) - filter duplicate patches from different sources (#223844) - mark some strings for translation. -- r4812 +- r4812 ------------------------------------------------------------------- Mon Dec 18 13:30:10 CET 2006 - jkupec@suse.cz @@ -368,7 +375,7 @@ ------------------------------------------------------------------- Sun Oct 29 02:27:24 CEST 2006 - ro@suse.de -- add missing return value +- add missing return value - also use RPM_OPT_FLAGS for C source ------------------------------------------------------------------- Modified: branches/SuSE-Linux-10_2-Branch/zypper/src/zypp-checkpatches-wrapper.c URL: http://svn.opensuse.org/viewcvs/zypp/branches/SuSE-Linux-10_2-Branch/zypper/src/zypp-checkpatches-wrapper.c?rev=7335&r1=7334&r2=7335&view=diff ============================================================================== --- branches/SuSE-Linux-10_2-Branch/zypper/src/zypp-checkpatches-wrapper.c (original) +++ branches/SuSE-Linux-10_2-Branch/zypper/src/zypp-checkpatches-wrapper.c Mon Sep 24 09:57:06 2007 @@ -1,8 +1,13 @@ /* A setuid-root wrapper for zypp-checkpatches */ +/* setgid, umask and open */ +#include +#include +#include +#include /* clearenv */ #include -/* chdir, execl, setuid */ +/* chdir, execl, setuid, exit */ #include /* perror */ #include @@ -11,7 +16,24 @@ const char *app = "/usr/sbin/zypp-checkpatches"; -int main (void) { +int main (void) +{ + /* see http://rechner.lst.de/~okir/blackhats/node41.html */ + while (1) { + int fd = open("/dev/null", O_RDWR); + if (fd < 0) + return WRAPPER_ERROR; + if (fd > 2) { + close(fd); + break; + } + } + + /* see http://rechner.lst.de/~okir/blackhats/node35.html */ + int fd = getdtablesize(); + while (fd-- > 2) + close(fd); + /* cd / to avoid NFS problems */ if (chdir ("/")) { perror ("chdir"); @@ -25,12 +47,21 @@ } /* set minimal environment... done */ /* prevent the user from sending signals */ + + if (initgroups("root", 0) != 0 || setgid (0) != 0) { + perror ("setuid"); + fprintf (stderr, "Forgot to chmod this program?\n"); + return WRAPPER_ERROR; + } + if (setuid (0)) { perror ("setuid"); fprintf (stderr, "Forgot to chmod this program?\n"); return WRAPPER_ERROR; } - + + umask(0022); + /* execute the real application */ execl (app, app, (char *) NULL); -- To unsubscribe, e-mail: zypp-commit+unsubscribe@opensuse.org For additional commands, e-mail: zypp-commit+help@opensuse.org