From owner-svn-src-all@FreeBSD.ORG Mon Feb 27 05:49:00 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D0C1D106566C; Mon, 27 Feb 2012 05:49:00 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id B378B8FC12; Mon, 27 Feb 2012 05:49:00 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q1R5n0Pm000115; Mon, 27 Feb 2012 05:49:00 GMT (envelope-from delphij@svn.freebsd.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q1R5n0gG000113; Mon, 27 Feb 2012 05:49:00 GMT (envelope-from delphij@svn.freebsd.org) Message-Id: <201202270549.q1R5n0gG000113@svn.freebsd.org> From: Xin LI Date: Mon, 27 Feb 2012 05:49:00 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r232202 - head/usr.sbin/cron/crontab X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2012 05:49:01 -0000 Author: delphij Date: Mon Feb 27 05:49:00 2012 New Revision: 232202 URL: http://svn.freebsd.org/changeset/base/232202 Log: Drop setuid status while doing file operations to prevent potential information leak. This changeset is intended to be a minimal one to make backports easier. Reviewed by: kevlo, remko MFC after: 1 week Modified: head/usr.sbin/cron/crontab/crontab.c Modified: head/usr.sbin/cron/crontab/crontab.c ============================================================================== --- head/usr.sbin/cron/crontab/crontab.c Sun Feb 26 23:06:30 2012 (r232201) +++ head/usr.sbin/cron/crontab/crontab.c Mon Feb 27 05:49:00 2012 (r232202) @@ -194,6 +194,17 @@ parse_args(argc, argv) } if (Option == opt_replace) { + /* relinquish the setuid status of the binary during + * the open, lest nonroot users read files they should + * not be able to read. we can't use access() here + * since there's a race condition. thanks go out to + * Arnt Gulbrandsen for spotting + * the race. + */ + + if (swap_uids() < OK) + err(ERROR_EXIT, "swapping uids"); + /* we have to open the file here because we're going to * chdir(2) into /var/cron before we get around to * reading the file. @@ -204,21 +215,11 @@ parse_args(argc, argv) !strcmp(resolved_path, SYSCRONTAB)) { err(ERROR_EXIT, SYSCRONTAB " must be edited manually"); } else { - /* relinquish the setuid status of the binary during - * the open, lest nonroot users read files they should - * not be able to read. we can't use access() here - * since there's a race condition. thanks go out to - * Arnt Gulbrandsen for spotting - * the race. - */ - - if (swap_uids() < OK) - err(ERROR_EXIT, "swapping uids"); if (!(NewCrontab = fopen(Filename, "r"))) err(ERROR_EXIT, "%s", Filename); - if (swap_uids_back() < OK) - err(ERROR_EXIT, "swapping uids back"); } + if (swap_uids_back() < OK) + err(ERROR_EXIT, "swapping uids back"); } Debug(DMISC, ("user=%s, file=%s, option=%s\n", @@ -363,11 +364,15 @@ edit_cmd() { goto fatal; } again: + if (swap_uids() < OK) + err(ERROR_EXIT, "swapping uids"); if (stat(Filename, &statbuf) < 0) { warn("stat"); fatal: unlink(Filename); exit(ERROR_EXIT); } + if (swap_uids_back() < OK) + err(ERROR_EXIT, "swapping uids back"); if (statbuf.st_dev != fsbuf.st_dev || statbuf.st_ino != fsbuf.st_ino) errx(ERROR_EXIT, "temp file must be edited in place"); if (MD5File(Filename, orig_md5) == NULL) { @@ -433,6 +438,8 @@ edit_cmd() { editor, WTERMSIG(waiter), WCOREDUMP(waiter) ?"" :"no "); goto fatal; } + if (swap_uids() < OK) + err(ERROR_EXIT, "swapping uids"); if (stat(Filename, &statbuf) < 0) { warn("stat"); goto fatal; @@ -443,6 +450,8 @@ edit_cmd() { warn("MD5"); goto fatal; } + if (swap_uids_back() < OK) + err(ERROR_EXIT, "swapping uids back"); if (strcmp(orig_md5, new_md5) == 0 && !syntax_error) { warnx("no changes made to crontab"); goto remove;