From owner-svn-ports-all@freebsd.org Fri Jul 17 22:35:20 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 9EF16370DC5; Fri, 17 Jul 2020 22:35:20 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4B7mCr36Lpz4dwX; Fri, 17 Jul 2020 22:35:20 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 46C9220A0F; Fri, 17 Jul 2020 22:35:20 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 06HMZKiL044775; Fri, 17 Jul 2020 22:35:20 GMT (envelope-from jbeich@FreeBSD.org) Received: (from jbeich@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 06HMZJYr044773; Fri, 17 Jul 2020 22:35:19 GMT (envelope-from jbeich@FreeBSD.org) Message-Id: <202007172235.06HMZJYr044773@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jbeich set sender to jbeich@FreeBSD.org using -f From: Jan Beich Date: Fri, 17 Jul 2020 22:35:19 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r542455 - in branches/2020Q3/x11/swaylock: . files X-SVN-Group: ports-branches X-SVN-Commit-Author: jbeich X-SVN-Commit-Paths: in branches/2020Q3/x11/swaylock: . files X-SVN-Commit-Revision: 542455 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2020 22:35:20 -0000 Author: jbeich Date: Fri Jul 17 22:35:19 2020 New Revision: 542455 URL: https://svnweb.freebsd.org/changeset/ports/542455 Log: MFH: r542454 x11/swaylock: limit root to authenticating child process Taken from initialize_pw_backend in shadow.c. PR: 248053 Approved by: ports-secteam blanket Modified: branches/2020Q3/x11/swaylock/Makefile branches/2020Q3/x11/swaylock/files/patch-pam.c Directory Properties: branches/2020Q3/ (props changed) Modified: branches/2020Q3/x11/swaylock/Makefile ============================================================================== --- branches/2020Q3/x11/swaylock/Makefile Fri Jul 17 22:34:38 2020 (r542454) +++ branches/2020Q3/x11/swaylock/Makefile Fri Jul 17 22:35:19 2020 (r542455) @@ -2,7 +2,7 @@ PORTNAME= swaylock DISTVERSION= 1.5 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= x11 MAINTAINER= jbeich@FreeBSD.org Modified: branches/2020Q3/x11/swaylock/files/patch-pam.c ============================================================================== --- branches/2020Q3/x11/swaylock/files/patch-pam.c Fri Jul 17 22:34:38 2020 (r542454) +++ branches/2020Q3/x11/swaylock/files/patch-pam.c Fri Jul 17 22:35:19 2020 (r542455) @@ -1,8 +1,9 @@ pam_unix(8) requires root priveleges to access master.passwd(5) +but don't keep root for non-authentication activities. --- pam.c.orig 2019-01-29 19:48:00 UTC +++ pam.c -@@ -12,12 +12,14 @@ +@@ -12,15 +12,40 @@ static char *pw_buf = NULL; void initialize_pw_backend(int argc, char **argv) { @@ -13,7 +14,33 @@ pam_unix(8) requires root priveleges to access master. " backend. Run 'chmod a-s %s' to fix. Aborting.", argv[0]); exit(EXIT_FAILURE); } ++#else ++ if (geteuid() != 0) { ++ swaylock_log(LOG_ERROR, ++ "swaylock needs to be setuid for pam_unix(8) to read /etc/master.passwd"); ++ exit(EXIT_FAILURE); ++ } +#endif ++ if (!spawn_comm_child()) { exit(EXIT_FAILURE); } ++ ++#ifndef __linux__ ++ if (setgid(getgid()) != 0) { ++ swaylock_log_errno(LOG_ERROR, "Unable to drop root"); ++ exit(EXIT_FAILURE); ++ } ++ if (setuid(getuid()) != 0) { ++ swaylock_log_errno(LOG_ERROR, "Unable to drop root"); ++ exit(EXIT_FAILURE); ++ } ++ if (setuid(0) != -1) { ++ swaylock_log_errno(LOG_ERROR, "Unable to drop root (we shouldn't be " ++ "able to restore it after setuid)"); ++ exit(EXIT_FAILURE); ++ } ++#endif + } + + static int handle_conversation(int num_msg, const struct pam_message **msg,