summaryrefslogtreecommitdiff
path: root/patches/source/polkit/CVE-2011-1485/0001-PolkitUnixProcess-Clarify-that-the-real-uid-is-retur.patch
diff options
context:
space:
mode:
Diffstat (limited to 'patches/source/polkit/CVE-2011-1485/0001-PolkitUnixProcess-Clarify-that-the-real-uid-is-retur.patch')
-rw-r--r--patches/source/polkit/CVE-2011-1485/0001-PolkitUnixProcess-Clarify-that-the-real-uid-is-retur.patch122
1 files changed, 122 insertions, 0 deletions
diff --git a/patches/source/polkit/CVE-2011-1485/0001-PolkitUnixProcess-Clarify-that-the-real-uid-is-retur.patch b/patches/source/polkit/CVE-2011-1485/0001-PolkitUnixProcess-Clarify-that-the-real-uid-is-retur.patch
new file mode 100644
index 00000000..e448ce95
--- /dev/null
+++ b/patches/source/polkit/CVE-2011-1485/0001-PolkitUnixProcess-Clarify-that-the-real-uid-is-retur.patch
@@ -0,0 +1,122 @@
+From 83a65f1255fc3eebfb4be1f80a5ab0b5f98eef7c Mon Sep 17 00:00:00 2001
+From: David Zeuthen <davidz@redhat.com>
+Date: Mon, 11 Apr 2011 11:38:22 -0400
+Subject: [PATCH 1/6] PolkitUnixProcess: Clarify that the real uid is
+ returned, not the effective one
+
+On Linux, also switch to parsing /proc/<pid>/status instead of relying
+on the st_uid returned by stat(2) to be the uid we want.
+
+This was pointed out by Neel Mehta <nmehta@google.com>. Thanks!
+
+Signed-off-by: David Zeuthen <davidz@redhat.com>
+---
+ src/polkit/polkitunixprocess.c | 58 ++++++++++++++++++++++++++++++++-------
+ 1 files changed, 47 insertions(+), 11 deletions(-)
+
+diff --git a/src/polkit/polkitunixprocess.c b/src/polkit/polkitunixprocess.c
+index e132387..868e3c5 100644
+--- a/src/polkit/polkitunixprocess.c
++++ b/src/polkit/polkitunixprocess.c
+@@ -34,6 +34,7 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <errno.h>
++#include <stdio.h>
+
+ #include "polkitunixprocess.h"
+ #include "polkitsubject.h"
+@@ -207,6 +208,8 @@ polkit_unix_process_get_pid (PolkitUnixProcess *process)
+ *
+ * Gets the uid of the owner of @process.
+ *
++ * Note that this returns the real user-id (not the effective user-id) of @process.
++ *
+ * Returns: The UNIX user id of the owner for @process or 0 if @error is set.
+ **/
+ gint
+@@ -214,14 +217,18 @@ polkit_unix_process_get_owner (PolkitUnixProcess *process,
+ GError **error)
+ {
+ gint result;
++ gchar *contents;
++ gchar **lines;
+ #ifdef HAVE_FREEBSD
+ struct kinfo_proc p;
+ #else
+- struct stat statbuf;
+- char procbuf[32];
++ gchar filename[64];
++ guint n;
+ #endif
+
+ result = 0;
++ lines = NULL;
++ contents = NULL;
+
+ #ifdef HAVE_FREEBSD
+ if (get_kinfo_proc (process->pid, &p) == 0)
+@@ -237,22 +244,51 @@ polkit_unix_process_get_owner (PolkitUnixProcess *process,
+
+ result = p.ki_uid;
+ #else
+- g_snprintf (procbuf, sizeof procbuf, "/proc/%d", process->pid);
+- if (stat (procbuf, &statbuf) != 0)
++ /* see 'man proc' for layout of the status file
++ *
++ * Uid, Gid: Real, effective, saved set, and file system UIDs (GIDs).
++ */
++ g_snprintf (filename, sizeof filename, "/proc/%d/status", process->pid);
++ if (!g_file_get_contents (filename,
++ &contents,
++ NULL,
++ error))
+ {
+- g_set_error (error,
+- POLKIT_ERROR,
+- POLKIT_ERROR_FAILED,
+- "stat() failed for /proc/%d: %s",
+- process->pid,
+- g_strerror (errno));
+ goto out;
+ }
++ lines = g_strsplit (contents, "\n", -1);
++ for (n = 0; lines != NULL && lines[n] != NULL; n++)
++ {
++ gint real_uid, effective_uid;
++ if (!g_str_has_prefix (lines[n], "Uid:"))
++ continue;
++ if (sscanf (lines[n] + 4, "%d %d", &real_uid, &effective_uid) != 2)
++ {
++ g_set_error (error,
++ POLKIT_ERROR,
++ POLKIT_ERROR_FAILED,
++ "Unexpected line `%s' in file %s",
++ lines[n],
++ filename);
++ goto out;
++ }
++ else
++ {
++ result = real_uid;
++ goto out;
++ }
++ }
+
+- result = statbuf.st_uid;
++ g_set_error (error,
++ POLKIT_ERROR,
++ POLKIT_ERROR_FAILED,
++ "Didn't find any line starting with `Uid:' in file %s",
++ filename);
+ #endif
+
+ out:
++ g_strfreev (lines);
++ g_free (contents);
+
+ return result;
+ }
+--
+1.7.4.4
+