From owner-svn-src-head@freebsd.org  Wed Feb  7 00:19:13 2018
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 021BAF15EC6;
 Wed,  7 Feb 2018 00:19:13 +0000 (UTC)
 (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net)
Received: from pdx.rh.CN85.dnsmgr.net (br1.CN84in.dnsmgr.net [69.59.192.140])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 643716BF63;
 Wed,  7 Feb 2018 00:19:11 +0000 (UTC)
 (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net)
Received: from pdx.rh.CN85.dnsmgr.net (localhost [127.0.0.1])
 by pdx.rh.CN85.dnsmgr.net (8.13.3/8.13.3) with ESMTP id w170J86M018889;
 Tue, 6 Feb 2018 16:19:08 -0800 (PST)
 (envelope-from freebsd@pdx.rh.CN85.dnsmgr.net)
Received: (from freebsd@localhost)
 by pdx.rh.CN85.dnsmgr.net (8.13.3/8.13.3/Submit) id w170J8os018888;
 Tue, 6 Feb 2018 16:19:08 -0800 (PST) (envelope-from freebsd)
From: "Rodney W. Grimes" <freebsd@pdx.rh.CN85.dnsmgr.net>
Message-Id: <201802070019.w170J8os018888@pdx.rh.CN85.dnsmgr.net>
Subject: Re: svn commit: r328951 - head/etc/rc.d
In-Reply-To: <201802062135.w16LZfLD020197@repo.freebsd.org>
To: Mark Felder <feld@freebsd.org>
Date: Tue, 6 Feb 2018 16:19:08 -0800 (PST)
CC: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Reply-To: rgrimes@freebsd.org
X-Mailer: ELM [version 2.4ME+ PL121h (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Feb 2018 00:19:13 -0000

> Author: feld (ports committer)
> Date: Tue Feb  6 21:35:41 2018
> New Revision: 328951
> URL: https://svnweb.freebsd.org/changeset/base/328951
> 
> Log:
>   Refactor cleanvar to remove shell expansion vulnerability
>   
>   If any process creates a directory named "-P" in /var/run or
>   /var/spool/lock it will cause the purgedir function to start to rm -r /.
>   
>   Simplify a lot of complicated shell logic by leveraging find(1).
>   
>   Reviewed by:	allanjude
>   MFC after:	3 days
>   Differential Revision:	https://reviews.freebsd.org/D13778

Please be careful about use of binaries from /usr/bin in
/etc/rc.d, though in this case it is probably ok as /usr
has been mounted by the time cleanvar runs, that is not
always the case.


> Modified:
>   head/etc/rc.d/cleanvar
> 
> Modified: head/etc/rc.d/cleanvar
> ==============================================================================
> --- head/etc/rc.d/cleanvar	Tue Feb  6 21:01:38 2018	(r328950)
> +++ head/etc/rc.d/cleanvar	Tue Feb  6 21:35:41 2018	(r328951)
> @@ -19,34 +19,6 @@ stop_cmd=":"
>  extra_commands="reload"
>  reload_cmd="${name}_start"
>  
> -purgedir()
> -{
> -	local dir file
> -
> -	if [ $# -eq 0 ]; then
> -		purgedir .
> -	else
> -		for dir
> -		do
> -		(
> -			cd "$dir" && for file in .* *
> -			do
> -				# Skip over logging sockets
> -				[ -S "$file" -a "$file" = "log" ] && continue
> -				[ -S "$file" -a "$file" = "logpriv" ] && continue
> -				[ ."$file" = .. -o ."$file" = ... ] && continue
> -				if [ -d "$file" -a ! -L "$file" ]
> -				then
> -					purgedir "$file"
> -				else
> -					rm -f -- "$file"
> -				fi
> -			done
> -		)
> -		done
> -	fi
> -}
> -
>  cleanvar_prestart()
>  {
>  	# These files must be removed only the first time this script is run
> @@ -58,14 +30,17 @@ cleanvar_prestart()
>  cleanvar_start()
>  {
>  	if [ -d /var/run -a ! -f /var/run/clean_var ]; then
> -		purgedir /var/run
> +		# Skip over logging sockets
> +		find /var/run \( -type f -or -type s ! -name log -and ! -name logpriv \) -delete
>  		>/var/run/clean_var
>  	fi
>  	if [ -d /var/spool/lock -a ! -f /var/spool/lock/clean_var ]; then
> -		purgedir /var/spool/lock
> +		find /var/spool/lock -type f -delete
>  		>/var/spool/lock/clean_var
>  	fi
> -	rm -rf /var/spool/uucp/.Temp/*
> +	if [ -d /var/spool/uucp/.Temp ]; then
> +		find /var/spool/uucp/.Temp -delete
> +	fi
>  }
>  
>  load_rc_config $name
> 
> 

-- 
Rod Grimes                                                 rgrimes@freebsd.org