bugJailkit - Bugs: bug #38078, [PATCH] Fix: check if executable...

 
 

bug #38078: [PATCH] Fix: check if executable exists only if it specified as an absolute path

Submitter:  Jiri Horky <jirihorky>
Submitted:  Mon 14 Jan 2013 09:21:21 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 11 Apr 2013 09:49:22 AM UTC, comment #1: 

thanks for the patch. I removed the check for execuable[0]='.' because I don't see when we should use that as an permitted path.

again sorry for the late reply

Olivier Sessink <oli4>
Group administrator
Mon 14 Jan 2013 09:21:21 AM UTC, original submission:  

Hi,

prior to executing a specified command, jk_lsh first checks if the executable exists. If it does, it THEN checks whether it is in allowed commands or not.
This causes a problem when specifying a relative path to the executable (e.g. "ssh USER@host rsync --server") when there is a file/directory with the same name as the specified command. In case of rsync, we have "/usr/bin/rsync" allowed, but if the user has directory called "rsync" in its home, the first check will succeed (file exists) and checks against list of allowed commands will fail (because only "/usr/bin/rsync" is allowed) with message:

jk_lsh[7356]: WARNING: user USER (1000) tried to run 'rsync --server', which is not allowed according to /etc/jailkit/jk_lsh.ini

The attached patch fixes this behavior by checking if executable exists only if it is specified as an absolute path.


The patch was actually written by my colleague Lukas Hejtmanek.

Regards
Jiri Horky

Jiri Horky <jirihorky>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oli4 (Posted a comment)
  • -email is unavailable- added by jirihorky (Submitted the item)
  • -email is unavailable- added by jirihorky
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-04-11 oli4 StatusNone Fixed
        Open/ClosedOpen Closed
    2013-01-14 jirihorky Attached File- Added jailkit-current-dir-path.diff, #27256
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code