From owner-svn-src-all@FreeBSD.ORG Mon Mar 5 17:09:17 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 59FF8106566C; Mon, 5 Mar 2012 17:09:17 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 3ECD98FC25; Mon, 5 Mar 2012 17:09:17 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q25H9GZo095373; Mon, 5 Mar 2012 17:09:16 GMT (envelope-from delphij@svn.freebsd.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q25H9GkP095370; Mon, 5 Mar 2012 17:09:16 GMT (envelope-from delphij@svn.freebsd.org) Message-Id: <201203051709.q25H9GkP095370@svn.freebsd.org> From: Xin LI Date: Mon, 5 Mar 2012 17:09:16 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r232551 - stable/8/usr.sbin/cron/crontab X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2012 17:09:17 -0000 Author: delphij Date: Mon Mar 5 17:09:16 2012 New Revision: 232551 URL: http://svn.freebsd.org/changeset/base/232551 Log: MFC r232202: Drop setuid status while doing file operations to prevent potential information leak. This changeset is intended to be a minimal one to make backports easier. Reviewed by: kevlo, remko Modified: stable/8/usr.sbin/cron/crontab/crontab.c Directory Properties: stable/8/usr.sbin/cron/ (props changed) stable/8/usr.sbin/cron/crontab/ (props changed) Modified: stable/8/usr.sbin/cron/crontab/crontab.c ============================================================================== --- stable/8/usr.sbin/cron/crontab/crontab.c Mon Mar 5 17:08:42 2012 (r232550) +++ stable/8/usr.sbin/cron/crontab/crontab.c Mon Mar 5 17:09:16 2012 (r232551) @@ -194,6 +194,17 @@ parse_args(argc, argv) } if (Option == opt_replace) { + /* relinquish the setuid status of the binary during + * the open, lest nonroot users read files they should + * not be able to read. we can't use access() here + * since there's a race condition. thanks go out to + * Arnt Gulbrandsen for spotting + * the race. + */ + + if (swap_uids() < OK) + err(ERROR_EXIT, "swapping uids"); + /* we have to open the file here because we're going to * chdir(2) into /var/cron before we get around to * reading the file. @@ -204,21 +215,11 @@ parse_args(argc, argv) !strcmp(resolved_path, SYSCRONTAB)) { err(ERROR_EXIT, SYSCRONTAB " must be edited manually"); } else { - /* relinquish the setuid status of the binary during - * the open, lest nonroot users read files they should - * not be able to read. we can't use access() here - * since there's a race condition. thanks go out to - * Arnt Gulbrandsen for spotting - * the race. - */ - - if (swap_uids() < OK) - err(ERROR_EXIT, "swapping uids"); if (!(NewCrontab = fopen(Filename, "r"))) err(ERROR_EXIT, "%s", Filename); - if (swap_uids_back() < OK) - err(ERROR_EXIT, "swapping uids back"); } + if (swap_uids_back() < OK) + err(ERROR_EXIT, "swapping uids back"); } Debug(DMISC, ("user=%s, file=%s, option=%s\n", @@ -363,11 +364,15 @@ edit_cmd() { goto fatal; } again: + if (swap_uids() < OK) + err(ERROR_EXIT, "swapping uids"); if (stat(Filename, &statbuf) < 0) { warn("stat"); fatal: unlink(Filename); exit(ERROR_EXIT); } + if (swap_uids_back() < OK) + err(ERROR_EXIT, "swapping uids back"); if (statbuf.st_dev != fsbuf.st_dev || statbuf.st_ino != fsbuf.st_ino) errx(ERROR_EXIT, "temp file must be edited in place"); if (MD5File(Filename, orig_md5) == NULL) { @@ -433,6 +438,8 @@ edit_cmd() { editor, WTERMSIG(waiter), WCOREDUMP(waiter) ?"" :"no "); goto fatal; } + if (swap_uids() < OK) + err(ERROR_EXIT, "swapping uids"); if (stat(Filename, &statbuf) < 0) { warn("stat"); goto fatal; @@ -443,6 +450,8 @@ edit_cmd() { warn("MD5"); goto fatal; } + if (swap_uids_back() < OK) + err(ERROR_EXIT, "swapping uids back"); if (strcmp(orig_md5, new_md5) == 0 && !syntax_error) { warnx("no changes made to crontab"); goto remove;