bugJailkit - Bugs: bug #46930, Be more relax on jail group...

 
 

bug #46930: Be more relax on jail group ownership

Submitted by:  None
Submitted on:  Mon 18 Jan 2016 06:15:25 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 19 Jan 2016 10:35:56 AM UTC, comment #1:

Maybe this diff, I'm not good in code :)

--- jk_lib.py.orig Tue Jan 19 11:21:16 2016
+++ jk_lib.py Tue Jan 19 11:32:16 2016
@@ -65,18 +65,9 @@ def path_is_safe(path, failquiet=0):
if (failquiet == 0):
sys.stderr.write('ERROR: cannot lstat() '+path+'\n')
return -1
- if (sys.platform[-3:] == 'bsd'):
- # on freebsd root is in group wheel
- if (statbuf[stat.ST_UID] != 0 or statbuf[stat.ST_GID] != grp.getgrnam('wheel').gr_gid):
- sys.stderr.write('ERROR: '+path+' is not owned by root:wheel!\n')
- return -3
- else:
- if (statbuf[stat.ST_UID] != 0 or statbuf[stat.ST_GID] != 0):
- sys.stderr.write('ERROR: '+path+' is not owned by root:root!\n')
- return -3
- if ((statbuf[stat.ST_MODE] & stat.S_IWOTH or statbuf[stat.ST_MODE] & stat.S_IWGRP)and not stat.S_ISLNK(statbuf[stat.ST_MODE])):
- sys.stderr.write('ERROR: '+path+' is writable by group or others!')
- return -4
+ if (statbuf[stat.ST_UID] != 0 or (statbuf[stat.ST_GID] & 022 ) != 0):
+ sys.stderr.write('ERROR: '+path+' is not owned by root or bad mode!\n')
+ return -3
if (not stat.S_ISDIR(statbuf[stat.ST_MODE])):
if (stat.S_ISLNK(statbuf[stat.ST_MODE])):
# Fedora has moved /sbin /lib and /bin into /usr

Anonymous
Mon 18 Jan 2016 06:15:25 PM UTC, original submission:

Hi,

IMO we could be more relaxed on grp owner on jail dir. See how it is done in openssh chroot code:

if (st.st_uid != 0 || (st.st_mode & 022) != 0)
fatal("bad ownership or modes for chroot "
"directory %s\"%s\"",
cp == NULL ? "" : "component ", component);

Thus we could check jk_lib.py to something like this:

if (statbuf[stat.ST_UID] != 0 or os.stat(path).st_mode & 022 != 0):
sys.stderr.write('ERROR: '+path+' is not owned by root or wrong group ownership!\n')
return -3

j.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

No Changes Have Been Made to This Item

Back to the top


Powered by Savane 3.1-cleanup1