bugJailkit - Bugs: bug #46930, Be more relax on jail group...

 
 

bug #46930: Be more relax on jail group ownership

Submitted by:  None
Submitted on:  Mon 18 Jan 2016 06:15:25 PM UTC  
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 19 Jan 2016 10:35:56 AM UTC, comment #1: 

Maybe this diff, I'm not good in code :)

--- jk_lib.py.orig      Tue Jan 19 11:21:16 2016
+++ jk_lib.py   Tue Jan 19 11:32:16 2016
@@ -65,18 +65,9 @@ def path_is_safe(path, failquiet=0):
                if (failquiet == 0):
                        sys.stderr.write('ERROR: cannot lstat() '+path+'\n')
                return -1
-       if (sys.platform[-3:] == 'bsd'):
-               # on freebsd root is in group wheel
-               if (statbuf[stat.ST_UID] != 0 or statbuf[stat.ST_GID] != grp.getgrnam('wheel').gr_gid):
-                       sys.stderr.write('ERROR: '+path+' is not owned by root:wheel!\n')
-                       return -3
-       else:
-               if (statbuf[stat.ST_UID] != 0 or statbuf[stat.ST_GID] != 0):
-                       sys.stderr.write('ERROR: '+path+' is not owned by root:root!\n')
-                       return -3
-       if ((statbuf[stat.ST_MODE] & stat.S_IWOTH or statbuf[stat.ST_MODE] & stat.S_IWGRP)and not stat.S_ISLNK(statbuf[stat.ST_MODE])):
-               sys.stderr.write('ERROR: '+path+' is writable by group or others!')
-               return -4
+       if (statbuf[stat.ST_UID] != 0 or (statbuf[stat.ST_GID] & 022 ) != 0):
+               sys.stderr.write('ERROR: '+path+' is not owned by root or bad mode!\n')
+               return -3
        if (not stat.S_ISDIR(statbuf[stat.ST_MODE])):
                if (stat.S_ISLNK(statbuf[stat.ST_MODE])):
                        # Fedora has moved /sbin /lib and /bin into /usr

Anonymous
Mon 18 Jan 2016 06:15:25 PM UTC, original submission:  

Hi,

IMO we could be more relaxed on grp owner on jail dir. See how it is done in openssh chroot code:

                if (st.st_uid != 0 || (st.st_mode & 022) != 0)
                        fatal("bad ownership or modes for chroot "
                            "directory %s\"%s\"",
                            cp == NULL ? "" : "component ", component);

Thus we could check jk_lib.py to something like this:

                                                                                                 

                if (statbuf[stat.ST_UID] != 0 or os.stat(path).st_mode & 022 != 0):
                        sys.stderr.write('ERROR: '+path+' is not owned by root or wrong group ownership!\n')
                        return -3

j.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

 

 

No changes have been made to this item

Back to the top


Powered by Savane 3.5