libs/newlib-cygwin
libs/newlib-cygwin
4
0
Fork 0
mirror of git://sourceware.org/git/newlib-cygwin.git synced 2025-02-02 04:20:28 +08:00
Code Issues Projects Releases Wiki Activity

Cygwin: AF_UNIX: create_cmsg_data: check credentials

Browse Source 
If the user is not an administrator, check that the specified
credentials match the user's credentials.
This commit is contained in:
Ken Brown 2020-10-28 11:31:11 -04:00
parent e5f2a0b1c8
commit fab8f9b104
1 changed files with 30 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
winsup/cygwin/fhandler_socket_unix.cc
View File

@ -2537,10 +2537,7 @@ fhandler_socket_unix::readv (const struct iovec *const iov, int iovcnt,
/* For now, just support an ancillary data block consisting of a
single cmsghdr, containing SCM_CREDENTIALS.
FIXME: Check errnos below.
FIXME: We're supposed to check the credentials.
https://man7.org/linux/man-pages/man7/unix.7.html */
FIXME: Check errnos below. */
bool
fhandler_socket_unix::create_cmsg_data (af_unix_pkt_hdr_t *packet,
const struct msghdr *msg)
@ -2563,6 +2560,35 @@ fhandler_socket_unix::create_cmsg_data (af_unix_pkt_hdr_t *packet,
set_errno (EOPNOTSUPP);
return false;
}
/* Check credentials. */
struct ucred *cred = (struct ucred *) CMSG_DATA (cmsg);
/* FIXME: check_token_membership returns false even when running in
a privileged shell. Why? */
bool perms = check_token_membership (&well_known_admins_sid);
if (!perms)
{
tmp_pathbuf tp;
gid_t *gids = (gid_t *) tp.w_get ();
int num = getgroups (65536 / sizeof (*gids), gids);
for (int idx = 0; idx < num; ++idx)
if (gids[idx] == 544)
{
perms = true;
break;
}
}
if (perms)
/* FIXME: We don't have to check uid and gid, but we should still
check that the specified pid is the pid of an existing
process. */
;
else if (cred->pid != myself->pid || cred->uid != myself->uid
|| cred->gid != myself->gid)
{
set_errno (EPERM);
return false;
}
memcpy (AF_UNIX_PKT_CMSG (packet), msg->msg_control, msg->msg_controllen);
packet->pckt_len += msg->msg_controllen;
packet->cmsg_len = msg->msg_controllen;