From unknown Mon Apr 06 04:25:51 2026 X-Loop: owner@bugs.x2go.org Subject: Bug#293: Use initgroups() to initialize group access list Reply-To: Orion Poplawski , 293@bugs.x2go.org Resent-From: Orion Poplawski Resent-To: x2go-dev@lists.berlios.de Resent-CC: X2Go Developers X-Loop: owner@bugs.x2go.org Resent-Date: Thu, 29 Aug 2013 17:18:02 +0000 Resent-Message-ID: Resent-Sender: owner@bugs.x2go.org X-X2Go-PR-Message: report 293 X-X2Go-PR-Package: nx-libs X-X2Go-PR-Keywords: patch Received: via spool by submit@bugs.x2go.org id=B.137779633920783 (code B); Thu, 29 Aug 2013 17:18:02 +0000 Received: (at submit) by bugs.x2go.org; 29 Aug 2013 17:12:19 +0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ymir.das-netzwerkteam.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,T_DKIM_INVALID, URIBL_BLOCKED autolearn=ham version=3.3.2 Received: from mail.cora.nwra.com (mercury.cora.nwra.com [4.28.99.165]) by ymir (Postfix) with ESMTPS id 5D1EE5DB1C for ; Thu, 29 Aug 2013 19:12:17 +0200 (CEST) Received: from [10.10.20.7] (barry.cora.nwra.com [10.10.20.7]) (authenticated bits=0) by mail.cora.nwra.com (8.14.4/8.14.4) with ESMTP id r7THCEAM021436 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Thu, 29 Aug 2013 11:12:15 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=cora.nwra.com; s=default; t=1377796335; bh=A+w+KWoYcB1mIg1+NQNYM3VFOSlFjsBCwZSWwtBScxc=; h=Message-ID:Date:From:MIME-Version:To:Subject:Content-Type; b=ToWkLRC6YWnbq5k1wLXDE76vTjY2Bh9y2gGjA555R1qXYAo0fRioSZe6CR6YIFgA6 BBBVGJ0ziyV6SpNpttI2DzZbGjUbNge/NkedIICzL/Po0PxK+/U9LLv97d3LEE7bwY cxyNh0pDC3YaYX2BRdflyJ/+JAVCyaj+6RCVy6/c= Message-ID: <521F80EE.2010702@cora.nwra.com> Date: Thu, 29 Aug 2013 11:12:14 -0600 From: Orion Poplawski User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130805 Thunderbird/17.0.8 MIME-Version: 1.0 To: submit@bugs.x2go.org Content-Type: multipart/mixed; boundary="------------030909060902020301050909" This is a multi-part message in MIME format. --------------030909060902020301050909 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Package: nx-libs Tags: patch The Fedora review of nx-libs caught the following rpmlint issue: This executable is calling setuid and setgid without setgroups or initgroups. There is a high probability this mean it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. Ref POS36-C: https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges This patch adds initgroups() calls to code to initialize the supplemental group list. I'm done some minimal testing (can connect to a session with client and server running this code), but I'm note sure how much that exercised it. -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion@nwra.com Boulder, CO 80301 http://www.nwra.com --------------030909060902020301050909 Content-Type: text/x-patch; name="nx-libs-initgroups.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="nx-libs-initgroups.patch" diff --git a/nx-X11/programs/Xserver/os/utils.c b/nx-X11/programs/Xserver/os/utils.c index 7e62654..9b2431a 100644 --- a/nx-X11/programs/Xserver/os/utils.c +++ b/nx-X11/programs/Xserver/os/utils.c @@ -112,6 +112,9 @@ OR PERFORMANCE OF THIS SOFTWARE. #include #include /* for isspace */ #include +#include +#include +#include #if defined(DGUX) #include @@ -1770,6 +1773,7 @@ System(char *command) void (*csig)(int); #endif int status; + struct passwd *pwent; if (!command) return(1); @@ -1791,6 +1795,9 @@ System(char *command) case -1: /* error */ p = -1; case 0: /* child */ + pwent = getpwuid(getuid()); + if (initgroups(pwent->pw_name,getgid()) == -1) + _exit(127); if (setgid(getgid()) == -1) _exit(127); if (setuid(getuid()) == -1) diff --git a/nxcomp/Pipe.cpp b/nxcomp/Pipe.cpp index 7238d0c..aacbbae 100644 --- a/nxcomp/Pipe.cpp +++ b/nxcomp/Pipe.cpp @@ -21,6 +21,7 @@ #include #include #include +#include #include "Pipe.h" #include "Misc.h" @@ -234,6 +235,8 @@ FILE *Popen(char * const parameters[], const char *type) // Child. // + struct passwd *pwent = getpwuid(getuid()); + if (pwent) initgroups(pwent->pw_name,getgid()); setgid(getgid()); setuid(getuid()); --------------030909060902020301050909--