ericonr
/
util-linux
mirror of https://github.com/ericonr/util-linux.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

more: drop setuid permissions before executing anything 

Pagers are not expected to have setuid or setgid bits, but assuming such
mistake has taken place try to avoid privilege escalation.

Signed-off-by: Sami Kerola <kerolasa@iki.fi>
This commit is contained in:
Sami Kerola 2020-03-18 20:12:57 +00:00
parent 474c61c0a8
commit 8fb5fe304a
No known key found for this signature in database
GPG Key ID: 0D46FEF7E61DBB46
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
text-utils/more.c
View File

@ -1118,6 +1118,13 @@ static void execute(struct more_control *ctl, char *filename, char *cmd, ...)
}
va_end(argp);
if (geteuid() != getuid() || getegid() != getgid()) {
if (setuid(getuid()) < 0)
err(EXIT_FAILURE, _("setuid failed"));
if (setgid(getgid()) < 0)
err(EXIT_FAILURE, _("setgid failed"));
}
execvp(cmd, args);
errsv = errno;
fputs(_("exec failed\n"), stderr);