Add a New Comment Rich Markup
Maybe this diff, I'm not good in code :) --- jk_lib.py.orig Tue Jan 19 11:21:16 2016 +++ jk_lib.py Tue Jan 19 11:32:16 2016 @@ -65,18 +65,9 @@ def path_is_safe(path, failquiet=0): if (failquiet == 0): sys.stderr.write('ERROR: cannot lstat() '+path+'\n') return -1 - if (sys.platform[-3:] == 'bsd'): - # on freebsd root is in group wheel - if (statbuf[stat.ST_UID] != 0 or statbuf[stat.ST_GID] != grp.getgrnam('wheel').gr_gid): - sys.stderr.write('ERROR: '+path+' is not owned by root:wheel!\n') - return -3 - else: - if (statbuf[stat.ST_UID] != 0 or statbuf[stat.ST_GID] != 0): - sys.stderr.write('ERROR: '+path+' is not owned by root:root!\n') - return -3 - if ((statbuf[stat.ST_MODE] & stat.S_IWOTH or statbuf[stat.ST_MODE] & stat.S_IWGRP)and not stat.S_ISLNK(statbuf[stat.ST_MODE])): - sys.stderr.write('ERROR: '+path+' is writable by group or others!') - return -4 + if (statbuf[stat.ST_UID] != 0 or (statbuf[stat.ST_GID] & 022 ) != 0): + sys.stderr.write('ERROR: '+path+' is not owned by root or bad mode!\n') + return -3 if (not stat.S_ISDIR(statbuf[stat.ST_MODE])): if (stat.S_ISLNK(statbuf[stat.ST_MODE])): # Fedora has moved /sbin /lib and /bin into /usr
Hi, IMO we could be more relaxed on grp owner on jail dir. See how it is done in openssh chroot code: if (st.st_uid != 0 || (st.st_mode & 022) != 0) fatal("bad ownership or modes for chroot " "directory %s\"%s\"", cp == NULL ? "" : "component ", component); Thus we could check jk_lib.py to something like this: if (statbuf[stat.ST_UID] != 0 or os.stat(path).st_mode & 022 != 0): sys.stderr.write('ERROR: '+path+' is not owned by root or wrong group ownership!\n') return -3 j.
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.12