d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not delete the group wheel when bad argument is passed to pw groupdel -g

Browse Source 
Check that the -g argument is actually a number, if not report an error.
This argument is converted without checking with atoi(3) later so without this
check it converts any alpha entries into 0 meaning it deletes the group wheel

Add a regression test about it

PR:		90114
Reported by:	bkoenig@cs.tu-berlin.de
MFC after:	1 week
This commit is contained in:
Baptiste Daroussin 2014-10-28 14:54:04 +00:00
parent f2664bdf4b
commit 156ebc2878
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
usr.sbin/pw/pw_group.c
View File

@ -67,6 +67,11 @@ pw_group(struct userconf * cnf, int mode, struct cargs * args)
NULL NULL
}; };
if (a_gid != NULL) {
if (strspn(a_gid->val, "0123456789") != strlen(a_gid->val))
errx(EX_USAGE, "-g expects a number");
}
if (mode == M_LOCK || mode == M_UNLOCK) if (mode == M_LOCK || mode == M_UNLOCK)
errx(EX_USAGE, "'lock' command is not available for groups"); errx(EX_USAGE, "'lock' command is not available for groups");

12
usr.sbin/pw/tests/pw_delete.sh
View File

@ -18,7 +18,19 @@ rmuser_seperate_group_body() {
pw -V ${HOME} userdel test || atf_fail "delete the user" pw -V ${HOME} userdel test || atf_fail "delete the user"
} }
atf_test_case group_do_not_delete_wheel_if_group_unkown
group_do_not_delete_wheel_if_group_unkown_head() {
atf_set "descr" "Make sure we do not consider as gid 0 an unknown group"
}
group_do_not_delete_wheel_if_group_unkown_body() {
populate_etc_skel
atf_check -s exit:0 -o inline:"wheel:*:0:root\n" -x pw -V ${HOME} groupshow wheel
atf_check -e inline:"pw: -g expects a number\n" -s exit:64 -x pw -V ${HOME} groupdel -g I_do_not_exist
atf_check -s exit:0 -o "wheel:*:0:root\n" -x pw -V ${HOME} groupshow wheel
}
atf_init_test_cases() { atf_init_test_cases() {
atf_add_test_case rmuser_seperate_group atf_add_test_case rmuser_seperate_group
atf_add_test_case group_do_not_delete_wheel_if_group_unkown
} }