From nobody Tue Aug 5 11:52:49 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bxBcx5Vmwz64ND9; Tue, 05 Aug 2025 11:52:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bxBcx3Xfbz3tT9; Tue, 05 Aug 2025 11:52:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1754394769; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GtjDALwcAFI7nEPyc0yFQUmbxeDMNAo4+RMjAebkCdg=; b=cQqcJV346W80C72tfV0DMs3FKFFVCMANaO+Dh9mWlMYAGeTxcXEMDDWUBxowVwTauAE5SG KHPZyllAzr4VplId3NqVT5HWggpInicAMFbKQlc+HgVe6nyR1kekcjykT3RPyMQ8sFeDRj /oV2XD+bMyFb0iBex5inihOFPijqtx6esQOb4Q3KdHsPXNQ21BD8y3Ai6YXTuuCszgKzA2 cZDLbfl0aoSl+zZZMrg5rxFW7JPD13u6Vs5j4k1+6SmymYYDNKltLwdXsO+1/LyQ8j8DRc C2WZL921cwLLyksk+XKMxOVuF8mwmTX94p8mbVe8+OKxv7SwWjI2xTAEnQJGKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1754394769; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GtjDALwcAFI7nEPyc0yFQUmbxeDMNAo4+RMjAebkCdg=; b=CiXvhlpE+Ae4RwrZFI0A7z27WBofmDq6DGOKDxlFcAJwDt4VUJJeNJZaFegP5SbpIKulHr Z/pU/FY5ITRFDpbGutn966UF5CiBdHED9Mt3kKDI8IZ8E/d+dmhN/uLJy9xPWrh8WIvDVF Ad7yV6NNfPN22DC4F49acmpuUXNOkC462uW9FJPiOaZ8GhEor8FZJe2FIB0FNPb0XPEBkC NK9nIBiNbwwqECazELDtL/3pys2Zh+99XDzeSIwLTDY3UYsT0611M3dlQ5qEYslldy8ClM m3+OVCK6vaKut+UzY7muyDh+An0HcW96EYX5BIrTMq/JeRITC6El8gR647vNKg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1754394769; a=rsa-sha256; cv=none; b=putnEvMKrN79Icf+7jDFYPLnoVBR3/OQ0i0r8SFg884xwOFG3hYRFdDFZvT3sxeEQuzoX6 fCQjjjBAGJzuI0/RgeJl/YMq6/gfqHVPqGOoIKOtun/GPoRmYOZY4iBIX4QjHnbzLHHQd/ FBnmM6oFYPoc+22s0op62J57+fef3mJMJpuw9n+4ZlgsHXSHlH4Idd3GSiOs+heMD2ZY4Q j5mobgOWL5XQnhLrI4rG4p81oULtm4lkTWdPtUWqhqAaWOAKs5o082KV26WkpTjveViYF1 ART10gl1On2DfE4AiOGugXqa5JRvU4/JB6VFppJjhR8d0cKY/S8gH3tlpaFrmw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bxBcx30fCzZZ0; Tue, 05 Aug 2025 11:52:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 575Bqnu5024626; Tue, 5 Aug 2025 11:52:49 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 575Bqnui024623; Tue, 5 Aug 2025 11:52:49 GMT (envelope-from git) Date: Tue, 5 Aug 2025 11:52:49 GMT Message-Id: <202508051152.575Bqnui024623@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Dag-Erling =?utf-8?Q?Sm=C3=B8rgrav?= Subject: git: 6ca3734e928c - stable/13 - comsat: Don't read arbitrary files List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 6ca3734e928cc82f2f91b991be28c9900b2b4a07 Auto-Submitted: auto-generated The branch stable/13 has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=6ca3734e928cc82f2f91b991be28c9900b2b4a07 commit 6ca3734e928cc82f2f91b991be28c9900b2b4a07 Author: Dag-Erling Smørgrav AuthorDate: 2025-07-28 15:28:26 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2025-08-05 11:52:28 +0000 comsat: Don't read arbitrary files When processing a notification, instead of accepting any file name that doesn't begin with a slash, accept only file names that don't contain any slashes at all. This makes it possible to notify a user about a mailbox that doesn't bear their name, as long as they are permitted to read it, but prevents comsat from reading files outside the mail spool. PR: 270404 MFC after: 1 week Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D51580 (cherry picked from commit 4a4338d94401f0012380d4f1a4d332bd6d44fa8e) comsat: Don't return from the child Fixes: 91629228e3df MFC after: 1 week Reviewed by: emaste Differential Revision: https://reviews.freebsd.org/D51581 (cherry picked from commit e40a2c4927a8068d7b6adee69c90ae3be8efc4df) --- libexec/comsat/comsat.c | 40 ++++++++++++++-------------------------- 1 file changed, 14 insertions(+), 26 deletions(-) diff --git a/libexec/comsat/comsat.c b/libexec/comsat/comsat.c index 2358336be61a..f40123a5ef09 100644 --- a/libexec/comsat/comsat.c +++ b/libexec/comsat/comsat.c @@ -125,29 +125,24 @@ mailfor(char *name) char *file; off_t offset; int folder; - char buf[sizeof(_PATH_MAILDIR) + sizeof(utp->ut_user) + 1]; - char buf2[sizeof(_PATH_MAILDIR) + sizeof(utp->ut_user) + 1]; + char buf[MAXPATHLEN]; - if (!(cp = strchr(name, '@'))) + if ((cp = strchr(name, '@')) == NULL) return; *cp = '\0'; offset = strtoll(cp + 1, NULL, 10); - if (!(cp = strchr(cp + 1, ':'))) - file = name; - else - file = cp + 1; - sprintf(buf, "%s/%.*s", _PATH_MAILDIR, (int)sizeof(utp->ut_user), - name); - if (*file != '/') { - sprintf(buf2, "%s/%.*s", _PATH_MAILDIR, - (int)sizeof(utp->ut_user), file); - file = buf2; + if ((cp = strchr(cp + 1, ':')) != NULL && + strchr((file = cp + 1), '/') == NULL) { + snprintf(buf, sizeof(buf), "%s/%s", _PATH_MAILDIR, file); + folder = 1; + } else { + snprintf(buf, sizeof(buf), "%s/%s", _PATH_MAILDIR, name); + folder = 0; } - folder = strcmp(buf, file); setutxent(); while ((utp = getutxent()) != NULL) if (utp->ut_type == USER_PROCESS && !strcmp(utp->ut_user, name)) - notify(utp, file, offset, folder); + notify(utp, buf, offset, folder); endutxent(); } @@ -171,8 +166,7 @@ notify(struct utmpx *utp, char file[], off_t offset, int folder) utp->ut_line); return; } - (void)snprintf(tty, sizeof(tty), "%s%.*s", - _PATH_DEV, (int)sizeof(utp->ut_line), utp->ut_line); + (void)snprintf(tty, sizeof(tty), "%s%s", _PATH_DEV, utp->ut_line); if (stat(tty, &stb) == -1 || !(stb.st_mode & (S_IXUSR | S_IXGRP))) { dsyslog(LOG_DEBUG, "%s: wrong mode on %s", utp->ut_user, tty); return; @@ -199,26 +193,20 @@ notify(struct utmpx *utp, char file[], off_t offset, int folder) initgroups(p->pw_name, p->pw_gid) == -1 || setgid(p->pw_gid) == -1 || setuid(p->pw_uid) == -1) - return; + _exit(1); - switch (stb.st_mode & (S_IXUSR | S_IXGRP)) { - case S_IXUSR: - case (S_IXUSR | S_IXGRP): + if (stb.st_mode & S_IXUSR) { (void)fprintf(tp, "%s\007New mail for %s@%.*s\007 has arrived%s%s%s:%s----%s", cr, utp->ut_user, (int)sizeof(hostname), hostname, folder ? cr : "", folder ? "to " : "", folder ? file : "", cr, cr); jkfprintf(tp, file, offset); - break; - case S_IXGRP: + } else if (stb.st_mode & S_IXGRP) { (void)fprintf(tp, "\007"); (void)fflush(tp); (void)sleep(1); (void)fprintf(tp, "\007"); - break; - default: - break; } (void)fclose(tp); _exit(0);