Messages in this thread | | | Date | Tue, 11 Jan 2000 18:26:19 -0500 (EST) | From | Chris Wing <> | Subject | Re: Suspicious code in uid16? |
| |
Pauline:
> Every function correctly uses the high2lowgid and low2highgid > stuff correctly, except those 2. I presume the array we read > /write from user space contains 16 bits gids, so they must > be converted to 32 bit gids, yes?
Yes, that's what the wrappers for setgroups and getgroups do:
asmlinkage long sys_getgroups16(int gidsetsize, old_gid_t *grouplist) { old_gid_t groups[NGROUPS]; <---- a 16-bit integer type
...
for(j=0;j<i;j++) groups[j] = current->groups[j]; if (copy_to_user(grouplist, groups, sizeof(old_gid_t)*i)) return -EFAULT;
...
You're right, I should have put high2lowgid() there. Thanks for pointing this out.
> I'm also puzzled by the sys_setuid16() and sys_setgid16() functions, > but I assume the high/low functions are not needed here, since > the -1 value has no special meaning here? > > Hmmm, come to think of it, the group function have probably the > same reasoning?
Yep, low2highuid() and low2highgid() are only needed for system calls that interpreted -1 as having a special meaning before. These are:
chown(), fchown(), lchown(), setreuid(), setregid(), setresuid(), setresgid()
I overlooked this fact when I was first writing a 32-bit UID patch (for Linux 2.0 over a year ago), and noticed that the old set-uid root xterm didn't work :)
Thanks, Chris Wing wingc@engin.umich.edu
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |