|
 |
a6ea154 |
From 3cac85a3f97d0a22270166f428209f873b58c319 Mon Sep 17 00:00:00 2001
|
|
|
a6ea154 |
From: Chris Leech <cleech@redhat.com>
|
|
|
a6ea154 |
Date: Tue, 11 Jun 2013 11:25:27 -0700
|
|
|
a6ea154 |
Subject: [PATCH] iscsid: fix order of setting uid/gid and drop supplementary
|
|
|
a6ea154 |
groups
|
|
|
a6ea154 |
|
|
|
a6ea154 |
If using the user and group ID settings together the existing order of
|
|
|
a6ea154 |
calling setuid first will almost always cause the setgid call to fail,
|
|
|
a6ea154 |
assuming the new effective user id does not have the CAP_SETGID
|
|
|
a6ea154 |
capability. The effective group ID needs to change first.
|
|
|
a6ea154 |
|
|
|
a6ea154 |
While we're at it, if iscsid is started as root it should drop any
|
|
|
a6ea154 |
inherited supplementary group permissions.
|
|
|
a6ea154 |
|
|
|
a6ea154 |
And if anyone is actually using this to try and isolate capabilities,
|
|
|
a6ea154 |
they probably care enough to want to known that it is failing. Make
|
|
|
a6ea154 |
iscsid startup fail instead of just calling perror.
|
|
|
a6ea154 |
|
|
|
a6ea154 |
Signed-off-by: Chris Leech <cleech@redhat.com>
|
|
|
a6ea154 |
---
|
|
|
a6ea154 |
usr/iscsid.c | 23 +++++++++++++++++++----
|
|
|
a6ea154 |
1 file changed, 19 insertions(+), 4 deletions(-)
|
|
|
a6ea154 |
|
|
|
a6ea154 |
diff --git a/usr/iscsid.c b/usr/iscsid.c
|
|
|
a6ea154 |
index b4bb65b..c0ea6fa 100644
|
|
|
a6ea154 |
--- a/usr/iscsid.c
|
|
|
a6ea154 |
+++ b/usr/iscsid.c
|
|
|
a6ea154 |
@@ -27,6 +27,7 @@
|
|
|
a6ea154 |
#include <unistd.h>
|
|
|
a6ea154 |
#include <string.h>
|
|
|
a6ea154 |
#include <signal.h>
|
|
|
a6ea154 |
+#include <grp.h>
|
|
|
a6ea154 |
#include <sys/mman.h>
|
|
|
a6ea154 |
#include <sys/utsname.h>
|
|
|
a6ea154 |
#include <sys/types.h>
|
|
|
a6ea154 |
@@ -477,11 +478,25 @@ int main(int argc, char *argv[])
|
|
|
a6ea154 |
}
|
|
|
a6ea154 |
}
|
|
|
a6ea154 |
|
|
|
a6ea154 |
- if (uid && setuid(uid) < 0)
|
|
|
a6ea154 |
- perror("setuid\n");
|
|
|
a6ea154 |
+ if (gid && setgid(gid) < 0) {
|
|
|
a6ea154 |
+ log_error("Unable to setgid to %d\n", gid);
|
|
|
a6ea154 |
+ log_close(log_pid);
|
|
|
a6ea154 |
+ exit(ISCSI_ERR);
|
|
|
a6ea154 |
+ }
|
|
|
a6ea154 |
|
|
|
a6ea154 |
- if (gid && setgid(gid) < 0)
|
|
|
a6ea154 |
- perror("setgid\n");
|
|
|
a6ea154 |
+ if ((geteuid() == 0) && (getgroups(0, NULL))) {
|
|
|
a6ea154 |
+ if (setgroups(0, NULL) != 0) {
|
|
|
a6ea154 |
+ log_error("Unable to drop supplementary group ids\n");
|
|
|
a6ea154 |
+ log_close(log_pid);
|
|
|
a6ea154 |
+ exit(ISCSI_ERR);
|
|
|
a6ea154 |
+ }
|
|
|
a6ea154 |
+ }
|
|
|
a6ea154 |
+
|
|
|
a6ea154 |
+ if (uid && setuid(uid) < 0) {
|
|
|
a6ea154 |
+ log_error("Unable to setuid to %d\n", uid);
|
|
|
a6ea154 |
+ log_close(log_pid);
|
|
|
a6ea154 |
+ exit(ISCSI_ERR);
|
|
|
a6ea154 |
+ }
|
|
|
a6ea154 |
|
|
|
a6ea154 |
memset(&daemon_config, 0, sizeof (daemon_config));
|
|
|
a6ea154 |
daemon_config.pid_file = pid_file;
|
|
|
a6ea154 |
--
|
|
|
a6ea154 |
1.8.1.4
|
|
|
a6ea154 |
|