This is an automated email from the git hooks/post-receive script. x2go pushed a commit to branch 3.6.x in repository nx-libs. commit 415b20b6fbf562d4132fca90a00b6c32d94040ed Author: Orion Poplawski <orion@cora.nwra.com> Date: Fri Feb 13 13:32:17 2015 +0100 Be compliant with POS36-C: Observe correct revocation order while relinquishing privileges (602_nx-X11_initgroups.full.patch). The Fedora review of NX (redistributed) caught the following rpmlint issue: This executable is calling setuid and setgid without setgroups or initgroups. There is a high probability this mean it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. Ref POS36-C: https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observ... This patch adds initgroups() calls to the code to initialize the supplemental group list. --- debian/patches/602_nx-X11_initgroups.full.patch | 67 ----------------------- debian/patches/series | 1 - nx-X11/programs/Xserver/os/utils.c | 7 +++ nxcomp/Pipe.cpp | 3 + 4 files changed, 10 insertions(+), 68 deletions(-) diff --git a/debian/patches/602_nx-X11_initgroups.full.patch b/debian/patches/602_nx-X11_initgroups.full.patch deleted file mode 100644 index 182b378..0000000 --- a/debian/patches/602_nx-X11_initgroups.full.patch +++ /dev/null @@ -1,67 +0,0 @@ -Description: Be compliant with POS36-C: Observe correct revocation order while relinquishing privileges -Author: Orion Poplawski <orion@cora.nwra.com> -Abstract: - The Fedora review of NX (redistributed) caught the following rpmlint issue: - . - This executable is calling setuid and setgid without setgroups or initgroups. - There is a high probability this mean it didn't relinquish all groups, and this - would be a potential security issue to be fixed. Seek POS36-C on the web for - details about the problem. - . - Ref POS36-C: - https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observ... - . - This patch adds initgroups() calls to the code to initialize the supplemental group list. -diff --git a/nx-X11/programs/Xserver/os/utils.c b/nx-X11/programs/Xserver/os/utils.c -index 7e62654..9b2431a 100644 ---- a/nx-X11/programs/Xserver/os/utils.c -+++ b/nx-X11/programs/Xserver/os/utils.c -@@ -112,6 +112,9 @@ OR PERFORMANCE OF THIS SOFTWARE. - #include <sys/stat.h> - #include <ctype.h> /* for isspace */ - #include <stdarg.h> -+#include <sys/types.h> -+#include <grp.h> -+#include <pwd.h> - - #if defined(DGUX) - #include <sys/resource.h> -@@ -1770,6 +1773,7 @@ System(char *command) - void (*csig)(int); - #endif - int status; -+ struct passwd *pwent; - - if (!command) - return(1); -@@ -1791,6 +1795,9 @@ System(char *command) - case -1: /* error */ - p = -1; - case 0: /* child */ -+ pwent = getpwuid(getuid()); -+ if (initgroups(pwent->pw_name,getgid()) == -1) -+ _exit(127); - if (setgid(getgid()) == -1) - _exit(127); - if (setuid(getuid()) == -1) -diff --git a/nxcomp/Pipe.cpp b/nxcomp/Pipe.cpp -index 7238d0c..aacbbae 100644 ---- a/nxcomp/Pipe.cpp -+++ b/nxcomp/Pipe.cpp -@@ -21,6 +21,7 @@ - #include <pwd.h> - #include <sys/types.h> - #include <sys/wait.h> -+#include <grp.h> - - #include "Pipe.h" - #include "Misc.h" -@@ -234,6 +235,8 @@ FILE *Popen(char * const parameters[], const char *type) - // Child. - // - -+ struct passwd *pwent = getpwuid(getuid()); -+ if (pwent) initgroups(pwent->pw_name,getgid()); - setgid(getgid()); - setuid(getuid()); - diff --git a/debian/patches/series b/debian/patches/series index 21cf21d..c805706 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,5 +1,4 @@ #401_nxcomp_bigrequests-and-genericevent-extensions.full+lite.patch -602_nx-X11_initgroups.full.patch 603_nx-X11_compilation_warnings.full.patch 605_nxcomp_Types.h-dont-use-STL-internals-on-libc++.full+lite.patch 606_nx-X11_build-on-aarch64.full.patch diff --git a/nx-X11/programs/Xserver/os/utils.c b/nx-X11/programs/Xserver/os/utils.c index 7e62654..9b2431a 100644 --- a/nx-X11/programs/Xserver/os/utils.c +++ b/nx-X11/programs/Xserver/os/utils.c @@ -112,6 +112,9 @@ OR PERFORMANCE OF THIS SOFTWARE. #include <sys/stat.h> #include <ctype.h> /* for isspace */ #include <stdarg.h> +#include <sys/types.h> +#include <grp.h> +#include <pwd.h> #if defined(DGUX) #include <sys/resource.h> @@ -1770,6 +1773,7 @@ System(char *command) void (*csig)(int); #endif int status; + struct passwd *pwent; if (!command) return(1); @@ -1791,6 +1795,9 @@ System(char *command) case -1: /* error */ p = -1; case 0: /* child */ + pwent = getpwuid(getuid()); + if (initgroups(pwent->pw_name,getgid()) == -1) + _exit(127); if (setgid(getgid()) == -1) _exit(127); if (setuid(getuid()) == -1) diff --git a/nxcomp/Pipe.cpp b/nxcomp/Pipe.cpp index 7238d0c..aacbbae 100644 --- a/nxcomp/Pipe.cpp +++ b/nxcomp/Pipe.cpp @@ -21,6 +21,7 @@ #include <pwd.h> #include <sys/types.h> #include <sys/wait.h> +#include <grp.h> #include "Pipe.h" #include "Misc.h" @@ -234,6 +235,8 @@ FILE *Popen(char * const parameters[], const char *type) // Child. // + struct passwd *pwent = getpwuid(getuid()); + if (pwent) initgroups(pwent->pw_name,getgid()); setgid(getgid()); setuid(getuid()); -- Alioth's /srv/git/_hooks_/post-receive-email on /srv/git/code.x2go.org/nx-libs.git