Date: Sat, 18 Aug 2001 22:12:58 -0700 From: Kris Kennaway <kris@obsecurity.org> To: audit@FreeBSD.org Subject: Checking issetugid() with getenv() in libraries Message-ID: <20010818221258.A79194@xor.obsecurity.org>
next in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
There were a number of places where library routines blindly use
getenv() in ways which may be insecure if called from setugid code.
Please review the following.
I also changed the uthread_info.c to respect TMPDIR if !issetugid()
instead of dumping to /tmp always.
Kris
Index: libc/db/test/dbtest.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libc/db/test/dbtest.c,v
retrieving revision 1.4
diff -u -r1.4 dbtest.c
--- libc/db/test/dbtest.c 2000/08/04 10:50:21 1.4
+++ libc/db/test/dbtest.c 2001/08/19 04:25:47
@@ -155,7 +155,8 @@
* want it around, and it often screws up tests.
*/
if (fname == NULL) {
- p = getenv("TMPDIR");
+ if (issetugid() == 0)
+ p = getenv("TMPDIR");
if (p == NULL)
p = "/var/tmp";
(void)snprintf(buf, sizeof(buf), "%s/__dbtest", p);
Index: libc/gen/exec.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libc/gen/exec.c,v
retrieving revision 1.16
diff -u -r1.16 exec.c
--- libc/gen/exec.c 2001/01/24 12:59:21 1.16
+++ libc/gen/exec.c 2001/08/19 04:25:23
@@ -224,7 +224,7 @@
}
/* Get the path we're searching. */
- if (!(path = getenv("PATH")))
+ if (issetugid() != 0 || !(path = getenv("PATH")))
path = _PATH_DEFPATH;
cur = alloca(strlen(path) + 1);
if (cur == NULL) {
Index: libc/rpc/getnetpath.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libc/rpc/getnetpath.c,v
retrieving revision 1.1
diff -u -r1.1 getnetpath.c
--- libc/rpc/getnetpath.c 2001/03/19 12:49:51 1.1
+++ libc/rpc/getnetpath.c 2001/08/19 04:35:18
@@ -105,7 +105,7 @@
}
np_sessionp->valid = NP_VALID;
np_sessionp->ncp_list = NULL;
- if ((npp = getenv(NETPATH)) == NULL) {
+ if (issetugid() != 0 || (npp = getenv(NETPATH)) == NULL) {
np_sessionp->netpath = NULL;
} else {
(void) endnetconfig(np_sessionp->nc_handlep);/* won't need nc session*/
Index: libc/stdio/tmpfile.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libc/stdio/tmpfile.c,v
retrieving revision 1.6
diff -u -r1.6 tmpfile.c
--- libc/stdio/tmpfile.c 2001/07/07 04:08:32 1.6
+++ libc/stdio/tmpfile.c 2001/08/19 04:19:53
@@ -61,7 +61,8 @@
char *buf;
const char *tmpdir;
- tmpdir = getenv("TMPDIR");
+ if (issetugid() == 0)
+ tmpdir = getenv("TMPDIR");
if (tmpdir == NULL)
tmpdir = _PATH_TMP;
Index: libc_r/uthread/uthread_info.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libc_r/uthread/uthread_info.c,v
retrieving revision 1.19
diff -u -r1.19 uthread_info.c
--- libc_r/uthread/uthread_info.c 2001/04/10 04:19:20 1.19
+++ libc_r/uthread/uthread_info.c 2001/05/28 22:08:44
@@ -31,13 +31,14 @@
*
* $FreeBSD: src/lib/libc_r/uthread/uthread_info.c,v 1.19 2001/04/10 04:19:20 deischen Exp $
*/
+#include <errno.h>
+#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
-#include <fcntl.h>
#include <string.h>
-#include <unistd.h>
+#include <paths.h>
#include <pthread.h>
-#include <errno.h>
+#include <unistd.h>
#include "pthread_private.h"
#ifndef NELEMENTS
@@ -85,15 +86,21 @@
int fd;
int i;
pthread_t pthread;
- char tmpfile[128];
+ char *tmpdir;
+ char tmpfile[PATH_MAX];
pq_list_t *pq_list;
+ tmpdir = NULL;
+ if (issetugid() == 0)
+ tmpdir = getenv("TMPDIR");
+ if (tmpdir == NULL)
+ tmpdir = _PATH_TMP;
for (i = 0; i < 100000; i++) {
- snprintf(tmpfile, sizeof(tmpfile), "/tmp/uthread.dump.%u.%i",
- getpid(), i);
+ snprintf(tmpfile, sizeof(tmpfile), "%s/uthread.dump.%u.%i",
+ tmpdir, getpid(), i);
/* Open the dump file for append and create it if necessary: */
if ((fd = __sys_open(tmpfile, O_RDWR | O_CREAT | O_EXCL,
- 0666)) < 0) {
+ 0644)) < 0) {
/* Can't open the dump file. */
if (errno == EEXIST)
continue;
Index: libcompat/4.3/rexec.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libcompat/4.3/rexec.c,v
retrieving revision 1.6
diff -u -r1.6 rexec.c
--- libcompat/4.3/rexec.c 2000/08/04 11:15:48 1.6
+++ libcompat/4.3/rexec.c 2001/08/19 04:54:58
@@ -145,6 +145,8 @@
int t, i, c, usedefault = 0;
struct stat stb;
+ if (issetugid() != 0)
+ return (0); /* Don't read .netrc */
hdir = getenv("HOME");
if (hdir == NULL)
hdir = ".";
Index: libncp/ncpl_rcfile.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libncp/ncpl_rcfile.c,v
retrieving revision 1.3
diff -u -r1.3 ncpl_rcfile.c
--- libncp/ncpl_rcfile.c 2000/05/26 02:00:20 1.3
+++ libncp/ncpl_rcfile.c 2001/08/19 04:52:39
@@ -390,7 +390,8 @@
char *home, *fn;
int error;
- home = getenv("HOME");
+ if (issetugid() == 0)
+ home = getenv("HOME");
if (home) {
fn = malloc(strlen(home) + 20);
sprintf(fn, "%s/.nwfsrc", home);
Index: libss/pager.c
===================================================================
RCS file: /mnt/ncvs/src/lib/libss/pager.c,v
retrieving revision 1.5
diff -u -r1.5 pager.c
--- libss/pager.c 2000/12/09 09:35:33 1.5
+++ libss/pager.c 2001/08/19 04:56:47
@@ -81,7 +81,7 @@
sigsetmask(mask);
}
if (_ss_pager_name == (char *)NULL) {
- if ((_ss_pager_name = getenv("PAGER")) == (char *)NULL)
+ if (issetugid() !=0 || (_ss_pager_name = getenv("PAGER")) == (char *)NULL)
_ss_pager_name = MORE;
}
(void) execlp(_ss_pager_name, _ss_pager_name, (char *) NULL);
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org
iD8DBQE7f0rZWry0BWjoQKURAl4GAKCpRirZxSivGKofcK3KE8FleLC/pACgxxkn
bADUshcl3FDEuqbu6HAgvog=
=0C9n
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010818221258.A79194>