Messages in this thread | | | Date | 29 Sep 2013 19:15:31 -0400 | From | "George Spelvin" <> | Subject | Re: [PATCH] printk: Check real user/group id for %pK |
| |
The basic idea is good, but I'm not sure if this is the correct permission check to use.
After all, a setuid program might also want to give filtered access to a /proc file with some %pK values.
The fundamental problem is that %pK is using permissions at the time of the read(), while the general Unix rule that setuid programs expect is that permission is checked at open() time. pppd is an example; its options_fom_file() function (pppd/options.c:391 in the 2.4.5 release) does:
euid = geteuid(); if (check_prot && seteuid(getuid()) == -1) { option_error("unable to drop privileges to open %s: %m", filename); return 0; } f = fopen(filename, "r"); err = errno; if (check_prot && seteuid(euid) == -1) fatal("unable to regain privileges");
Now the whole struct cred and capability system is something I don't really understand, but it is clear from a brief look at the code that getting the appropriate credential through the seq_file to lib/vsprintf.c:pointer() would be tricky.
But it also seems like the Right Thing to do; other fixes seem like ineffective kludges.
| |