Ticket #37766: patch-suid-privchecks.diff

File patch-suid-privchecks.diff, 2.3 KB (added by mklein-de (Michael Klein), 11 years ago)

add additional checks when running SUID root

  • OpenFilesScreen.c 

    diff --git a/OpenFilesScreen.c b/OpenFilesScreen.c
index a312d0f..25b1904 100644
    a b static void OpenFilesScreen_draw(OpenFilesScreen* this) { 
    7676static OpenFiles_ProcessData* OpenFilesScreen_getProcessData(int pid) {
    7777   char command[1025];
    7878   snprintf(command, 1024, "lsof -p %d -F 2> /dev/null", pid);
     79   uid_t euid = geteuid();
     80   seteuid(getuid());
    7981   FILE* fd = popen(command, "r");
     82   seteuid(euid);
    8083   OpenFiles_ProcessData* process = calloc(sizeof(OpenFiles_ProcessData), 1);
     84   if (fd)
     85   {
    8186   OpenFiles_FileData* file = NULL;
    8287   OpenFiles_ProcessData* item = process;
    8388   process->failed = true;
    … … static OpenFiles_ProcessData* OpenFilesScreen_getProcessData(int pid) { 
    107112      item->data[cmd] = entry;
    108113   }
    109114   pclose(fd);
     115   }
    110116   return process;
    111117}
    112118

  • Process.c 

    diff --git a/Process.c b/Process.c
index cd9a887..42c4fe0 100644
    a b Process_toggleTag( Process * this ) { 
    587587
    588588bool
    589589Process_setPriority( Process * this, int priority ) {
    590   int old_prio = getpriority( PRIO_PROCESS, this->pid );
    591   int err = setpriority( PRIO_PROCESS, this->pid, priority );
    592   if ( err == 0 && old_prio != getpriority( PRIO_PROCESS, this->pid ) ) {
    593     this->nice = priority;
     590  if ( Process_getuid == 0 || Process_getuid == this->st_uid ) {
     591    int old_prio = getpriority( PRIO_PROCESS, this->pid );
     592    int err = setpriority( PRIO_PROCESS, this->pid, priority );
     593    if ( err == 0 && old_prio != getpriority( PRIO_PROCESS, this->pid ) ) {
     594      this->nice = priority;
     595    }
     596    return ( err == 0 );
    594597  }
    595   return ( err == 0 );
     598  else
     599    return false;
    596600}
    597601
    598602unsigned long
    … … Process_setAffinity( Process * this, unsigned long mask ) { 
    607611
    608612void
    609613Process_sendSignal( Process * this, int signal ) {
    610   kill( this->pid, signal );
     614    if ( Process_getuid == 0 || Process_getuid == this->st_uid )
     615        kill( this->pid, signal );
    611616}
    612617
    613618int

  • TraceScreen.c 

    diff --git a/TraceScreen.c b/TraceScreen.c
index 19254f9..0fd86b6 100644
    a b void TraceScreen_run(TraceScreen* this) { 
    7070   int child = fork();
    7171   if (child == -1) return;
    7272   if (child == 0) {
     73      seteuid(getuid());
    7374      dup2(fdpair[1], STDERR_FILENO);
    7475      fcntl(fdpair[1], F_SETFL, O_NONBLOCK);
    7576      sprintf(buffer, "%d", this->process->pid);