below are my patches: for 1.3.9 /proc (security is OK, but ps showing
real uid doesn't seem to be a good idea for me; this causes ftpd to
be displayed like running as root); and for 1.2.11 - the same patch
merged with /proc and FIOSETOWN security fixes (they are already
in the development kernel since 1.3.7).
After they are well tested, I hope to see them back in 1.2.xx too...
Thanks!
Marek
----------
diff -urN v1.3.9/linux/fs/proc/inode.c linux/fs/proc/inode.c
--- v1.3.9/linux/fs/proc/inode.c Thu Jul 6 12:24:46 1995
+++ linux/fs/proc/inode.c Wed Jul 12 18:26:55 1995
@@ -232,8 +232,8 @@
ino &= 0x0000ffff;
if (ino == PROC_PID_INO ||
(p->dumpable && p->uid == p->euid && p->gid == p->egid)) {
- inode->i_uid = p->uid;
- inode->i_gid = p->gid;
+ inode->i_uid = p->euid;
+ inode->i_gid = p->egid;
}
switch (ino) {
case PROC_PID_INO:
----------
----------
diff -urN v1.2.11/linux/fs/exec.c linux/fs/exec.c
--- v1.2.11/linux/fs/exec.c Mon Jan 30 12:08:04 1995
+++ linux/fs/exec.c Wed Jul 12 18:28:07 1995
@@ -509,7 +509,8 @@
int ch;
char * name;
- current->dumpable = 1;
+ if (current->euid == current->uid && current->egid == current->gid)
+ current->dumpable = 1;
name = bprm->filename;
for (i=0; (ch = *(name++)) != '\0';) {
if (ch == '/')
diff -urN v1.2.11/linux/fs/proc/inode.c linux/fs/proc/inode.c
--- v1.2.11/linux/fs/proc/inode.c Mon Jun 26 15:17:56 1995
+++ linux/fs/proc/inode.c Wed Jul 12 18:30:47 1995
@@ -194,9 +194,10 @@
return;
}
ino &= 0x0000ffff;
- if (p->dumpable && p->uid == p->euid && p->gid == p->egid) {
- inode->i_uid = p->uid;
- inode->i_gid = p->gid;
+ if (ino == PROC_PID_INO ||
+ (p->dumpable && p->uid == p->euid && p->gid == p->egid)) {
+ inode->i_uid = p->euid;
+ inode->i_gid = p->egid;
}
switch (ino) {
case PROC_PID_INO:
diff -urN v1.2.11/linux/kernel/sys.c linux/kernel/sys.c
--- v1.2.11/linux/kernel/sys.c Sat Mar 4 23:16:36 1995
+++ linux/kernel/sys.c Wed Jul 12 18:28:08 1995
@@ -195,6 +195,7 @@
asmlinkage int sys_setregid(gid_t rgid, gid_t egid)
{
int old_rgid = current->gid;
+ int old_egid = current->egid;
if (rgid != (gid_t) -1) {
if ((old_rgid == rgid) ||
@@ -219,6 +220,8 @@
(egid != (gid_t) -1 && egid != old_rgid))
current->sgid = current->egid;
current->fsgid = current->egid;
+ if (current->egid != old_egid)
+ current->dumpable = 0;
return 0;
}
@@ -227,12 +230,16 @@
*/
asmlinkage int sys_setgid(gid_t gid)
{
+ int old_egid = current->egid;
+
if (suser())
current->gid = current->egid = current->sgid = current->fsgid = gid;
else if ((gid == current->gid) || (gid == current->sgid))
current->egid = current->fsgid = gid;
else
return -EPERM;
+ if (current->egid != old_egid)
+ current->dumpable = 0;
return 0;
}
@@ -284,6 +291,7 @@
asmlinkage int sys_setreuid(uid_t ruid, uid_t euid)
{
int old_ruid = current->uid;
+ int old_euid = current->euid;
if (ruid != (uid_t) -1) {
if ((old_ruid == ruid) ||
@@ -308,6 +316,8 @@
(euid != (uid_t) -1 && euid != old_ruid))
current->suid = current->euid;
current->fsuid = current->euid;
+ if (current->euid != old_euid)
+ current->dumpable = 0;
return 0;
}
@@ -324,12 +334,16 @@
*/
asmlinkage int sys_setuid(uid_t uid)
{
+ int old_euid = current->euid;
+
if (suser())
current->uid = current->euid = current->suid = current->fsuid = uid;
else if ((uid == current->uid) || (uid == current->suid))
current->fsuid = current->euid = uid;
else
return -EPERM;
+ if (current->euid != old_euid)
+ current->dumpable = 0;
return(0);
}
@@ -346,6 +360,8 @@
if (uid == current->uid || uid == current->euid ||
uid == current->suid || uid == current->fsuid || suser())
current->fsuid = uid;
+ if (current->fsuid != old_fsuid)
+ current->dumpable = 0;
return old_fsuid;
}
@@ -359,6 +375,8 @@
if (gid == current->gid || gid == current->egid ||
gid == current->sgid || gid == current->fsgid || suser())
current->fsgid = gid;
+ if (current->fsgid != old_fsgid)
+ current->dumpable = 0;
return old_fsgid;
}
diff -urN v1.2.11/linux/net/inet/af_inet.c linux/net/inet/af_inet.c
--- v1.2.11/linux/net/inet/af_inet.c Tue Jun 13 15:18:50 1995
+++ linux/net/inet/af_inet.c Wed Jul 12 18:57:04 1995
@@ -1260,6 +1260,7 @@
{
struct sock *sk=(struct sock *)sock->data;
int err;
+ int pid;
switch(cmd)
{
@@ -1268,7 +1269,11 @@
err=verify_area(VERIFY_READ,(int *)arg,sizeof(long));
if(err)
return err;
- sk->proc = get_fs_long((int *) arg);
+ pid = get_fs_long((int *) arg);
+ /* see inet_fcntl */
+ if (current->pid != pid && current->pgrp != -pid && !suser())
+ return -EPERM;
+ sk->proc = pid;
return(0);
case FIOGETOWN:
case SIOCGPGRP:
----------