NetBSD Problem Report #2597

From gnats  Tue Jul  2 17:22:20 1996
Received: from kechara.flame.org by pain.lcs.mit.edu (8.7.5/8.7.3) with ESMTP id RAA05906 for <gnats-bugs@gnats.netbsd.org>; Tue, 2 Jul 1996 17:00:31 -0400 (EDT)
Message-Id: <199607022035.QAA16099@zhaneel.flame.org>
Date: Tue, 2 Jul 1996 16:35:14 -0400 (EDT)
From: Michael Graff <explorer@flame.org>
Reply-To: explorer@flame.org
To: gnats-bugs@NetBSD.ORG
Subject: lpr and NFS-non-root-exported fails
X-Send-Pr-Version: 3.95

>Number:         2597
>Category:       bin
>Synopsis:       lpr and NFS-non-root-exported fails
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    explorer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 02 17:35:06 +0000 1996
>Closed-Date:    Sat Aug 10 20:09:39 +0000 1996
>Last-Modified:  Mon Jan 23 07:30:01 +0000 2006
>Originator:     Michael Graff
>Release:        -current<NetBSD-current source date>
>Organization:
flame.org:  yes, we do know everything
>Environment:

System: NetBSD zhaneel.flame.org 1.2A NetBSD 1.2A (ZHANEEL) #0: Tue Jul 2 11:28:09 EDT 1996 explorer@zhaneel.flame.org:/usr/src/sys/arch/i386/compile/ZHANEEL i386


>Description:
When printing a mode 600 file, owned by ``explorer'' on an NFS mounted
directory which does NOT export root=0, lpr cannot print the file.

Note that I can't see the point of using seteuid(0) just before open()
is called on the input file...  That seems like a security hole
waiting to happen.

I believe these patches are correct.  In any case, they should either
break lpr or strengthen security, since I added no seteuid() calls,
and modified only to lower the priveledges obtained.

>How-To-Repeat:
See above.

>Fix:

Apply this patch:

Index: lpr.c
===================================================================
RCS file: /a/cvsroot/src/usr.sbin/lpr/lpr/lpr.c,v
retrieving revision 1.10
diff -c -r1.10 lpr.c
*** lpr.c	1996/03/21 18:12:25	1.10
--- lpr.c	1996/07/02 20:28:01
***************
*** 354,360 ****
  		}
  		if (sflag)
  			printf("%s: %s: not linked, copying instead\n", name, arg);
! 		seteuid(euid);
  		if ((i = open(arg, O_RDONLY)) < 0) {
  			seteuid(uid);
  			printf("%s: cannot open %s\n", name, arg);
--- 355,361 ----
  		}
  		if (sflag)
  			printf("%s: %s: not linked, copying instead\n", name, arg);
! 		seteuid(uid);
  		if ((i = open(arg, O_RDONLY)) < 0) {
  			seteuid(uid);
  			printf("%s: cannot open %s\n", name, arg);
***************
*** 457,465 ****
  	register int ret;

  	if (*file != '/') {
- 		seteuid(euid);
  		if (getcwd(buf, BUFSIZ) == NULL) {
- 			seteuid(uid);
  			return(NULL);
  		}
  		while (file[0] == '.') {
--- 458,464 ----
***************
*** 587,593 ****
  	register int fd;
  	register char *cp;

! 	seteuid(euid);
  	if (access(file, 4) < 0) {
  		printf("%s: cannot access %s\n", name, file);
  		goto bad;
--- 586,592 ----
  	register int fd;
  	register char *cp;

! 	seteuid(uid);
  	if (access(file, 4) < 0) {
  		printf("%s: cannot access %s\n", name, file);
  		goto bad;
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: explorer 
State-Changed-When: Sat Aug 10 16:09:39 EDT 1996 
State-Changed-Why:  
Applied patch. 


Responsible-Changed-From-To: bin-bug-people->explorer 
Responsible-Changed-By: explorer 
Responsible-Changed-When: Sat Aug 10 16:09:39 EDT 1996 
Responsible-Changed-Why:  
I applied it.  In fact, I submitted the pr.  :) 
From: Marc Recht <recht@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: PR/2597 CVS commit: pkgsrc/multimedia/gmplayer
Date: Mon, 23 Jan 2006 07:25:16 +0000 (UTC)

 Module Name:	pkgsrc
 Committed By:	recht
 Date:		Mon Jan 23 07:25:16 UTC 2006

 Modified Files:
 	pkgsrc/multimedia/gmplayer: Makefile distinfo

 Log Message:
 Change DIST_SUBDIR - skins have been updated on master site again.
 Adresses PR 2597 by David H. Gutteridge


 To generate a diff of this commit:
 cvs rdiff -r1.41 -r1.42 pkgsrc/multimedia/gmplayer/Makefile
 cvs rdiff -r1.32 -r1.33 pkgsrc/multimedia/gmplayer/distinfo

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search