folkslinux
/
rpm
mirror of https://github.com/rpm-software-management/rpm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Strip s-bits on upgrade too (RhBug:598775) 

- Previously only actual package removal would clear s-bits from
  s[ug]id files. This needs to be done on upgrade too to prevent
  leaving vulnerable hardlinks of s[ug]id binaries around.
This commit is contained in:
Panu Matilainen 2010-06-02 09:15:48 +03:00
parent 49b4dea69d
commit ca2d6b2b48
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/fsm.c
View File

@ -1261,6 +1261,16 @@ static int fsmMkdirs(FSM_t fsm)
return rc;
}
static void removeSBITS(const char *path)
{
struct stat stb;
if (lstat(path, &stb) == 0) {
if (S_ISREG(stb.st_mode) && (stb.st_mode & 06000) != 0) {
(void) chmod(path, stb.st_mode & 0777);
}
}
}
#define IS_DEV_LOG(_x) \
((_x) != NULL && strlen(_x) >= (sizeof("/dev/log")-1) && \
rstreqn((_x), "/dev/log", sizeof("/dev/log")-1) && \
@ -1956,11 +1966,8 @@ if (!(fsm->mapFlags & CPIO_ALL_HARDLINKS)) break;
break;
case FSM_UNLINK:
if (fsm->mapFlags & CPIO_SBIT_CHECK) {
struct stat stb;
if (lstat(fsm->path, &stb) == 0 && S_ISREG(stb.st_mode) && (stb.st_mode & 06000) != 0)
chmod(fsm->path, stb.st_mode & 0777);
}
if (fsm->mapFlags & CPIO_SBIT_CHECK)
removeSBITS(fsm->path);
rc = unlink(fsm->path);
if (_fsm_debug && (stage & FSM_SYSCALL))
rpmlog(RPMLOG_DEBUG, " %8s (%s) %s\n", cur,
@ -1969,6 +1976,8 @@ if (!(fsm->mapFlags & CPIO_ALL_HARDLINKS)) break;
rc = (errno == ENOENT ? CPIOERR_ENOENT : CPIOERR_UNLINK_FAILED);
break;
case FSM_RENAME:
if (fsm->mapFlags & CPIO_SBIT_CHECK)
removeSBITS(fsm->path);
rc = rename(fsm->opath, fsm->path);
#if defined(ETXTBSY) && defined(__HPUX__)
if (rc && errno == ETXTBSY) {