d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

For processes which are set-user-ID or set-group-ID, the kernel performs a few

Browse Source 
special actions for safety.  One of these is to make sure that file descriptors
0..2 are in use, by opening /dev/null for those that are not already open.
Another is to close any file descriptors 0..2 that reference procfs.  However,
these checks were made out of order, so that it was still possible for a
set-user-ID or set-group-ID process to be started with some of the file
descriptors 0..2 unused.

Submitted by:	Georgi Guninski <guninski@guninski.com>
This commit is contained in:
Jacques Vidrine 2002-07-30 15:38:29 +00:00
parent 9ea8ab8314
commit 89ab930718
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/kern/kern_exec.c
View File

@ -403,6 +403,8 @@ execve(td, uap)
mtx_unlock(&ktrace_mtx);
}
#endif
/* Close any file descriptors 0..2 that reference procfs */
setugidsafety(td);
/* Make sure file descriptors 0..2 are in use. */
error = fdcheckstd(td);
if (error != 0)
@ -415,7 +417,6 @@ execve(td, uap)
change_euid(newcred, euip);
if (attr.va_mode & VSGID)
change_egid(newcred, attr.va_gid);
setugidsafety(td);
/*
* Implement correct POSIX saved-id behavior.
*/