emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity
Files
9e854f525d2965e45b0bb2bcfa6761a990d0c751
shadow/libmisc
History
Samanta Navarro 812f934e77 process_prefix_flag: Drop privileges 
Using --prefix in a setuid binary is quite dangerous. An unprivileged
user could prepare a custom shadow file in home directory. During a data
race the user could exchange directories with links which could lead to
exchange of shadow file in system's /etc directory.

This could be used for local privilege escalation.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
2023-05-18 15:36:59 +02:00
..
.indent.pro
…
addgrps.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
age.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
agetpass.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
alloc.c
libmisc: Add safer allocation functions
2023-02-23 20:28:43 -06:00
audit_help.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
basename.c
Fix null dereference in basename
2023-03-27 10:10:37 -05:00
bit.c
Add bit manipulation functions
2023-01-30 18:24:15 +01:00
btrfs.c
…
chkname.c
shadow: use relaxed usernames
2022-09-02 20:27:14 -05:00
chkname.h
…
chowndir.c
Avoid races in chown_tree()
2022-08-17 12:34:01 -05:00
chowntty.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
cleanup_group.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
cleanup_user.c
Fix typos
2023-02-16 13:23:08 -06:00
cleanup.c
…
console.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
copydir.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
csrand.c
Unoptimize the higher part of the domain of csrand_uniform()
2023-01-30 18:24:15 +01:00
date_to_str.c
Fix crash with large timestamps
2023-03-28 13:00:38 +02:00
entry.c
libmisc: Move xmalloc.c to alloc.c
2023-02-23 20:28:43 -06:00
env.c
Fix use-after-free of pointer after realloc(3)
2023-02-23 20:28:43 -06:00
failure.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
failure.h
Disable utmpx permanently
2022-12-22 10:31:43 +01:00
find_new_gid.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
find_new_sub_gids.c
Don't redefine errno(3)
2022-12-22 11:43:29 +01:00
find_new_sub_uids.c
Don't redefine errno(3)
2022-12-22 11:43:29 +01:00
find_new_uid.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
getdate.h
…
getdate.y
…
getgr_nam_gid.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
getrange.c
…
gettime.c
Use strict prototype in definition
2023-03-20 08:47:52 +01:00
hushed.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
idmapping.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
idmapping.h
Add include for uid_t
2022-08-06 11:27:56 -05:00
isexpired.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
limits.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
list.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
log.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
loginprompt.c
login_prompt: Simplify login_prompt API
2023-05-03 07:54:28 -05:00
mail.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
Makefile.am
libmisc: Move xmalloc.c to alloc.c
2023-02-23 20:28:43 -06:00
mempcpy.c
Add mempcpy(3)
2023-02-16 11:29:33 +01:00
motd.c
libmisc: Move xmalloc.c to alloc.c
2023-02-23 20:28:43 -06:00
myname.c
…
obscure.c
libmisc, man: Drop old check and advice for complex character sets in passwords
2023-04-27 09:16:08 +02:00
pam_pass_non_interactive.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
pam_pass.c
Don't redefine errno(3)
2022-12-22 11:43:29 +01:00
prefix_flag.c
process_prefix_flag: Drop privileges
2023-05-18 15:36:59 +02:00
pwd2spwd.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
pwd_init.c
Assume SIGTTOU is defined
2022-12-15 16:22:05 -06:00
pwdcheck.c
Call NULL by its name
2023-02-02 13:08:30 -06:00
remove_tree.c
Avoid races in remove_tree()
2022-08-17 12:34:01 -05:00
rlogin.c
Assume B[0-9]* macros are defined
2022-12-15 16:22:05 -06:00
root_flag.c
libmisc/root_flag: add tips for --root flag only support abspath
2022-08-06 15:04:06 -05:00
salt.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
setugid.c
…
setupenv.c
Remove some static char arrays
2023-05-11 11:05:29 -05:00
shell.c
Call NULL by its name
2023-02-02 13:08:30 -06:00
stpecpy.c
Add stpecpy()
2023-02-16 11:29:33 +01:00
stpeprintf.c
Add stpeprintf()
2023-02-16 11:29:33 +01:00
strtoday.c
strtoday.c: remove unused defines.h inclusion
2022-12-22 10:39:45 -06:00
sub.c
…
sulog.c
Call NULL by its name
2023-02-02 13:08:30 -06:00
ttytype.c
ttytype(): Fix race
2023-02-09 10:03:03 -06:00
tz.c
Remove superfluous casts
2023-02-09 10:03:03 -06:00
ulimit.c
Remove comments that survived the Helicoprion
2022-12-15 16:22:05 -06:00
user_busy.c
Fix typo
2023-02-16 13:23:08 -06:00
utmp.c
Simplify is_my_tty()
2023-03-28 13:00:38 +02:00
valid.c
…
xgetgrgid.c
Fix comments
2023-02-16 13:23:08 -06:00
xgetgrnam.c
Fix comments
2023-02-16 13:23:08 -06:00
xgetpwnam.c
libmisc: fix grammar
2023-01-26 22:44:39 -06:00
xgetpwuid.c
Fix comments
2023-02-16 13:23:08 -06:00
xgetspnam.c
Fix comments
2023-02-16 13:23:08 -06:00
xgetXXbyYY.c
Use safer allocation macros
2023-02-23 20:28:43 -06:00
yesno.c
libmisc/yesno.c: Fix regression
2023-04-28 11:22:48 -05:00