Attachment 871615 Details for Bug 1218475

[patch] suggested fix

0001-pam_namespace-protect_dir-use-O_DIRECTORY-to-prevent.patch (text/plain), 1.67 KB, created by Matthias Gerstner on 2024-01-02 10:59:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthias Gerstner

Created: 2024-01-02 10:59:16 UTC

Size: 1.67 KB

patch

obsolete

>From 1df49a664720419e122dac128bf0ef1525133f4c Mon Sep 17 00:00:00 2001
>From: Matthias Gerstner <matthias.gerstner@suse.de>
>Date: Wed, 27 Dec 2023 14:01:59 +0100
>Subject: [PATCH] pam_namespace: protect_dir(): use O_DIRECTORY to prevent
> local DoS situations
>
>Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
>being placed in user controlled directories, causing the PAM module to
>block indefinitely during `openat()`.
>
>Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
>refer to a directory.
>
>With this the check whether the final path element is a directory
>becomes unnecessary, drop it.
>---
> modules/pam_namespace/pam_namespace.c | 18 +-----------------
> 1 file changed, 1 insertion(+), 17 deletions(-)
>
>diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
>index b7cdcfa4..286329bd 100644
>--- a/modules/pam_namespace/pam_namespace.c
>+++ b/modules/pam_namespace/pam_namespace.c
>@@ -1188,7 +1188,7 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
> 	int dfd = AT_FDCWD;
> 	int dfd_next;
> 	int save_errno;
>-	int flags = O_RDONLY;
>+	int flags = O_RDONLY | O_DIRECTORY;
> 	int rv = -1;
> 	struct stat st;
> 
>@@ -1242,22 +1242,6 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
> 		rv = openat(dfd, dir, flags);
> 	}
> 
>-	if (rv != -1) {
>-		if (fstat(rv, &st) != 0) {
>-			save_errno = errno;
>-			close(rv);
>-			rv = -1;
>-			errno = save_errno;
>-			goto error;
>-		}
>-		if (!S_ISDIR(st.st_mode)) {
>-			close(rv);
>-			errno = ENOTDIR;
>-			rv = -1;
>-			goto error;
>-		}
>-	}
>-
> 	if (flags & O_NOFOLLOW) {
> 		/* we are inside user-owned dir - protect */
> 		if (protect_mount(rv, p, idata) == -1) {
>-- 
>2.41.0
>

Actions: View | Diff

Attachments on bug 1218475: 871615