bugJailkit - Bugs: bug #38078, [PATCH] Fix: check if executable...

 
 

bug #38078: [PATCH] Fix: check if executable exists only if it specified as an absolute path

Submitted by:  Jiri Horky <jirihorky>
Submitted on:  Mon 14 Jan 2013 09:21:21 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 11 Apr 2013 09:49:22 AM UTC, comment #1:

thanks for the patch. I removed the check for execuable[0]='.' because I don't see when we should use that as an permitted path.

again sorry for the late reply

Olivier Sessink <oli4>
Project Administrator
Mon 14 Jan 2013 09:21:21 AM UTC, original submission:

Hi,

prior to executing a specified command, jk_lsh first checks if the executable exists. If it does, it THEN checks whether it is in allowed commands or not.
This causes a problem when specifying a relative path to the executable (e.g. "ssh USER@host rsync --server") when there is a file/directory with the same name as the specified command. In case of rsync, we have "/usr/bin/rsync" allowed, but if the user has directory called "rsync" in its home, the first check will succeed (file exists) and checks against list of allowed commands will fail (because only "/usr/bin/rsync" is allowed) with message:

jk_lsh[7356]: WARNING: user USER (1000) tried to run 'rsync --server', which is not allowed according to /etc/jailkit/jk_lsh.ini

The attached patch fixes this behavior by checking if executable exists only if it is specified as an absolute path.

The patch was actually written by my colleague Lukas Hejtmanek.

Regards
Jiri Horky

Jiri Horky <jirihorky>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by oli4 (Posted a comment)
  • -unavailable- added by jirihorky (Submitted the item)
  • -unavailable- added by jirihorky
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Apr 2013 09:49:22 AM UTColi4StatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Mon 14 Jan 2013 09:21:21 AM UTCjirihorkyAttached File-=>Added jailkit-current-dir-path.diff, #27256
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1