emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

Merge pull request #308 from martijndegouw/relaxgidcheck

Browse Source 
newuidmap,newgidmap: Relax gid checking to allow running under alternative group ID
This commit is contained in:
Serge Hallyn
2021-03-02 12:42:25 -06:00
committed by GitHub
parent c0818ab01d 246d5c1c25
commit 7273c25cc2
40 changed files with 1892 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/newgidmap.c
View File

@@ -39,6 +39,7 @@
#include "defines.h"
#include "prototypes.h"
#include "subordinateio.h"
#include "getdef.h"
#include "idmapping.h"
/*
@@ -60,7 +61,7 @@ static bool verify_range(struct passwd *pw, struct map_range *range, bool *allow
}
/* Allow a process to map its own gid. */
if ((range->count == 1) && (pw->pw_gid == range->lower)) {
if ((range->count == 1) && (getgid() == range->lower)) {
/* noop -- if setgroups is enabled already we won't disable it. */
return true;
}
@@ -228,9 +229,9 @@ int main(int argc, char **argv)
* mappings we have been asked to set.
*/
if ((getuid() != pw->pw_uid) ||
(getgid() != pw->pw_gid) ||
(!getdef_bool("GRANT_AUX_GROUP_SUBIDS") && (getgid() != pw->pw_gid)) ||
(pw->pw_uid != st.st_uid) ||
(pw->pw_gid != st.st_gid)) {
(getgid() != st.st_gid)) {
fprintf(stderr, _( "%s: Target %u is owned by a different user: uid:%lu pw_uid:%lu st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n" ),
Prog, target,
(unsigned long int)getuid(), (unsigned long int)pw->pw_uid, (unsigned long int)st.st_uid,

5
src/newuidmap.c
View File

@@ -39,6 +39,7 @@
#include "defines.h"
#include "prototypes.h"
#include "subordinateio.h"
#include "getdef.h"
#include "idmapping.h"
/*
@@ -158,9 +159,9 @@ int main(int argc, char **argv)
* mappings we have been asked to set.
*/
if ((getuid() != pw->pw_uid) ||
(getgid() != pw->pw_gid) ||
(!getdef_bool("GRANT_AUX_GROUP_SUBIDS") && (getgid() != pw->pw_gid)) ||
(pw->pw_uid != st.st_uid) ||
(pw->pw_gid != st.st_gid)) {
(getgid() != st.st_gid)) {
fprintf(stderr, _( "%s: Target process %u is owned by a different user: uid:%lu pw_uid:%lu st_uid:%lu, gid:%lu pw_gid:%lu st_gid:%lu\n" ),
Prog, target,
(unsigned long int)getuid(), (unsigned long int)pw->pw_uid, (unsigned long int)st.st_uid,