diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 1997-02-18 00:16:10 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 1997-02-18 00:16:10 +0000 |
| commit | f27a0609f64aa75de846569ef7f4593e1bb3bf75 (patch) | |
| tree | 3e3ef45cd3b6a03045494db25f814adc1d6a4c23 | |
| parent | 568c6f6c515a3f50f296a09737709ead913c740c (diff) | |
if a P_SUGIDEXEC proc execve()'s a non-set[ug]id program while running
with uid/gid mismatches, P_SUGIDEXEC should persist (in case the
environment has not been cleaned). pointed out by wietse@porcupine.org
| -rw-r--r-- | lib/libc/sys/issetugid.2 | 5 | ||||
| -rw-r--r-- | sys/kern/kern_exec.c | 14 |
2 files changed, 13 insertions, 6 deletions
diff --git a/lib/libc/sys/issetugid.2 b/lib/libc/sys/issetugid.2 index 73fa737529b..aca73d10e16 100644 --- a/lib/libc/sys/issetugid.2 +++ b/lib/libc/sys/issetugid.2 @@ -1,4 +1,4 @@ -.\" $OpenBSD: issetugid.2,v 1.6 1997/02/05 22:56:43 deraadt Exp $ +.\" $OpenBSD: issetugid.2,v 1.7 1997/02/18 00:16:09 deraadt Exp $ .\" .\" Copyright (c) 1980, 1991, 1993 .\" The Regents of the University of California. All rights reserved. @@ -65,7 +65,8 @@ the specified file. .Pp .Fn issetugid is unaffected by calls to -.Fn setuid +.Fn setuid , +.Fn fork , and other such calls. It is only controlled by .Fn execve . .Sh ERRORS diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 8b6ad57d2e0..7f06d1743be 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_exec.c,v 1.7 1996/08/31 09:24:09 pefo Exp $ */ +/* $OpenBSD: kern_exec.c,v 1.8 1997/02/18 00:16:05 deraadt Exp $ */ /* $NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $ */ /*- @@ -440,6 +440,14 @@ sys_execve(p, v, retval) } /* + * If process does execve() while it has euid/uid or egid/gid + * which are mismatched, it remains P_SUGIDEXEC. + */ + if (p->p_ucred->cr_uid == p->p_cred->p_ruid && + p->p_ucred->cr_gid == p->p_cred->p_rgid) + p->p_flag &= ~P_SUGIDEXEC; + + /* * deal with set[ug]id. * MNT_NOEXEC and P_TRACED have already been used to disable s[ug]id. */ @@ -462,10 +470,8 @@ sys_execve(p, v, retval) p->p_ucred->cr_gid = attr.va_gid; p->p_flag |= P_SUGID; p->p_flag |= P_SUGIDEXEC; - } else { + } else p->p_flag &= ~P_SUGID; - p->p_flag &= ~P_SUGIDEXEC; - } p->p_cred->p_svuid = p->p_ucred->cr_uid; p->p_cred->p_svgid = p->p_ucred->cr_gid; |