Compare commits
No commits in common. 'c9' and 'i10cs' have entirely different histories.
@ -1,113 +0,0 @@
|
|||||||
From 71b0389fbb31833d827f5f0fec18880c2f602753 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
||||||
Date: Thu, 19 May 2022 13:52:22 +0300
|
|
||||||
Subject: [PATCH] mkhomedir: add support for pre-CVE-2020-10737 behavior
|
|
||||||
|
|
||||||
Pre-CVE-2020-10737 behavior was used to allow creating home directories
|
|
||||||
on NFS mounts when non-Kerberos authentication method is in use. This is
|
|
||||||
exactly the case where a race condition addressed by the CVE-2020-10737
|
|
||||||
fix could have happened. However, there are legit use cases where this
|
|
||||||
setup is needed.
|
|
||||||
|
|
||||||
Add '-f' option to mkhomedir helper to activate previous behavior. In
|
|
||||||
order to enable it, a change to oddjobd-mkhomedir.conf configuration
|
|
||||||
file is needed by explicitly adding '-f' option to the executable file
|
|
||||||
definition.
|
|
||||||
|
|
||||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2050079
|
|
||||||
|
|
||||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
||||||
---
|
|
||||||
src/mkhomedir.c | 16 +++++++++++++---
|
|
||||||
src/oddjobd-mkhomedir.conf.5.in | 9 +++++++++
|
|
||||||
2 files changed, 22 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/mkhomedir.c b/src/mkhomedir.c
|
|
||||||
index be85959..ac813a9 100644
|
|
||||||
--- a/src/mkhomedir.c
|
|
||||||
+++ b/src/mkhomedir.c
|
|
||||||
@@ -53,9 +53,11 @@ static const char *skel;
|
|
||||||
static const char *skel_dir;
|
|
||||||
static struct passwd *pwd;
|
|
||||||
static mode_t override_umask;
|
|
||||||
+static int owner_mkdir_first = 0;
|
|
||||||
|
|
||||||
#define FLAG_POPULATE (1 << 0)
|
|
||||||
#define FLAG_QUIET (1 << 1)
|
|
||||||
+#define FLAG_OWNER_MKDIR_FIRST (1 << 2)
|
|
||||||
|
|
||||||
/* Given the path of an item somewhere in the skeleton directory, create as
|
|
||||||
* identical as possible a copy in the destination tree. */
|
|
||||||
@@ -158,7 +160,7 @@ copy_single_item(const char *source, const struct stat *sb,
|
|
||||||
* target user just yet to avoid potential race conditions
|
|
||||||
* involving symlink attacks when we copy over the skeleton
|
|
||||||
* tree. */
|
|
||||||
- if (status->level == 0) {
|
|
||||||
+ if (status->level == 0 && !owner_mkdir_first) {
|
|
||||||
uid = 0;
|
|
||||||
gid = 0;
|
|
||||||
}
|
|
||||||
@@ -222,6 +224,9 @@ mkhomedir(const char *user, int flags)
|
|
||||||
pwd->pw_dir);
|
|
||||||
return HANDLER_INVALID_INVOCATION;
|
|
||||||
}
|
|
||||||
+ if (flags & FLAG_OWNER_MKDIR_FIRST) {
|
|
||||||
+ owner_mkdir_first = 1;
|
|
||||||
+ }
|
|
||||||
if ((lstat(pwd->pw_dir, &st) == -1) && (errno == ENOENT)) {
|
|
||||||
/* Figure out which location we're using as a
|
|
||||||
* template. */
|
|
||||||
@@ -237,7 +242,7 @@ mkhomedir(const char *user, int flags)
|
|
||||||
int res = nftw(get_skel_dir(), copy_single_item, 5,
|
|
||||||
FTW_PHYS);
|
|
||||||
/* only now give ownership to the target user */
|
|
||||||
- if (res == 0) {
|
|
||||||
+ if (res == 0 && !owner_mkdir_first) {
|
|
||||||
res = chown(pwd->pw_dir, pwd->pw_uid, pwd->pw_gid);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -317,8 +322,11 @@ main(int argc, char **argv)
|
|
||||||
umask(override_umask);
|
|
||||||
skel_dir = "/etc/skel";
|
|
||||||
|
|
||||||
- while ((i = getopt(argc, argv, "nqs:u:")) != -1) {
|
|
||||||
+ while ((i = getopt(argc, argv, "nqfs:u:")) != -1) {
|
|
||||||
switch (i) {
|
|
||||||
+ case 'f':
|
|
||||||
+ flags |= FLAG_OWNER_MKDIR_FIRST;
|
|
||||||
+ break;
|
|
||||||
case 'n':
|
|
||||||
flags &= ~FLAG_POPULATE;
|
|
||||||
break;
|
|
||||||
@@ -339,6 +347,8 @@ main(int argc, char **argv)
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
fprintf(stderr, "Valid options:\n"
|
|
||||||
+ "-f\tCreate home directory initially owned by user, "
|
|
||||||
+ "not root. See man page for security issues.\n"
|
|
||||||
"-n\tDo not populate home directories, "
|
|
||||||
"just create them.\n"
|
|
||||||
"-q\tDo not print messages when creating "
|
|
||||||
diff --git a/src/oddjobd-mkhomedir.conf.5.in b/src/oddjobd-mkhomedir.conf.5.in
|
|
||||||
index d7a2429..6e35ad5 100644
|
|
||||||
--- a/src/oddjobd-mkhomedir.conf.5.in
|
|
||||||
+++ b/src/oddjobd-mkhomedir.conf.5.in
|
|
||||||
@@ -10,6 +10,15 @@ directory.
|
|
||||||
|
|
||||||
The mkhomedir helper itself accepts these options:
|
|
||||||
.TP
|
|
||||||
+-f
|
|
||||||
+Restore behavior before CVE-2020-10737 was fixed: create the home directory
|
|
||||||
+with user's ownership directly rather than create it as a root and only after
|
|
||||||
+populating it change to the user's ownership. The former behavior is insecure
|
|
||||||
+but may be used to allow creation of NFS-mounted home directories when
|
|
||||||
+non-Kerberos authentication is in use. It is prone for a race condition that
|
|
||||||
+could be exploited in the NFS-mounted home directories use case. To avoid
|
|
||||||
+CVE-2020-10737, do not use \fB-f\fR option in production environments.
|
|
||||||
+.TP
|
|
||||||
-q
|
|
||||||
Refrain from outputting the usual "Creating home directory..." message when it
|
|
||||||
creates a home directory.
|
|
||||||
--
|
|
||||||
2.37.1
|
|
||||||
|
|
||||||
@ -0,0 +1,28 @@
|
|||||||
|
From 3d30f6fec556f2eb53671832ae47687ace1fc655 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Yaakov Selkowitz <yselkowi@redhat.com>
|
||||||
|
Date: Wed, 13 Dec 2023 15:12:32 -0500
|
||||||
|
Subject: [PATCH] Fix build with libxml2-2.12.0
|
||||||
|
|
||||||
|
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.0
|
||||||
|
|
||||||
|
"Several cyclic dependencies in public header files were fixed. As a
|
||||||
|
result, certain headers won't include other headers as before."
|
||||||
|
---
|
||||||
|
src/oddjobd.c | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/src/oddjobd.c b/src/oddjobd.c
|
||||||
|
index 44de748..fb63c02 100644
|
||||||
|
--- a/src/oddjobd.c
|
||||||
|
+++ b/src/oddjobd.c
|
||||||
|
@@ -47,6 +47,7 @@
|
||||||
|
#include <string.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
#include <dbus/dbus.h>
|
||||||
|
+#include <libxml/globals.h>
|
||||||
|
#include <libxml/xmlreader.h>
|
||||||
|
#ifdef SELINUX_ACLS
|
||||||
|
#include <selinux/selinux.h>
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
Loading…
Reference in new issue