aboutsummaryrefslogtreecommitdiff
path: root/grp
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2015-10-02 11:34:13 +0200
committerFlorian Weimer <fweimer@redhat.com>2015-10-02 11:34:13 +0200
commit676599b36a92f3c201c5682ee7a5caddd9f370a4 (patch)
tree6860752c26ccab76ee9db5e60ff465d1edf25feb /grp
parentb0f81637d5bda47be93bac34b68f429a12979321 (diff)
downloadglibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.zip
glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.tar.gz
glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.tar.bz2
Harden putpwent, putgrent, putspent, putspent against injection [BZ #18724]
This prevents injection of ':' and '\n' into output functions which use the NSS files database syntax. Critical fields (user/group names and file system paths) are checked strictly. For backwards compatibility, the GECOS field is rewritten instead. The getent program is adjusted to use the put*ent functions in libc, instead of local copies. This changes the behavior of getent if user names start with '-' or '+'.
Diffstat (limited to 'grp')
-rw-r--r--grp/Makefile2
-rw-r--r--grp/putgrent.c15
-rw-r--r--grp/tst-putgrent.c167
3 files changed, 176 insertions, 8 deletions
diff --git a/grp/Makefile b/grp/Makefile
index c63b552..ed8cc2b 100644
--- a/grp/Makefile
+++ b/grp/Makefile
@@ -28,7 +28,7 @@ routines := fgetgrent initgroups setgroups \
getgrent getgrgid getgrnam putgrent \
getgrent_r getgrgid_r getgrnam_r fgetgrent_r
-tests := testgrp
+tests := testgrp tst-putgrent
ifeq (yes,$(build-shared))
test-srcs := tst_fgetgrent
diff --git a/grp/putgrent.c b/grp/putgrent.c
index e4d662c..1ac7f19 100644
--- a/grp/putgrent.c
+++ b/grp/putgrent.c
@@ -16,7 +16,9 @@
<http://www.gnu.org/licenses/>. */
#include <errno.h>
+#include <nss.h>
#include <stdio.h>
+#include <string.h>
#include <grp.h>
#define flockfile(s) _IO_flockfile (s)
@@ -27,13 +29,14 @@
/* Write an entry to the given stream.
This must know the format of the group file. */
int
-putgrent (gr, stream)
- const struct group *gr;
- FILE *stream;
+putgrent (const struct group *gr, FILE *stream)
{
int retval;
- if (__glibc_unlikely (gr == NULL) || __glibc_unlikely (stream == NULL))
+ if (__glibc_unlikely (gr == NULL) || __glibc_unlikely (stream == NULL)
+ || gr->gr_name == NULL || !__nss_valid_field (gr->gr_name)
+ || !__nss_valid_field (gr->gr_passwd)
+ || !__nss_valid_list_field (gr->gr_mem))
{
__set_errno (EINVAL);
return -1;
@@ -56,9 +59,7 @@ putgrent (gr, stream)
if (gr->gr_mem != NULL)
{
- int i;
-
- for (i = 0 ; gr->gr_mem[i] != NULL; i++)
+ for (size_t i = 0; gr->gr_mem[i] != NULL; i++)
if (fprintf (stream, i == 0 ? "%s" : ",%s", gr->gr_mem[i]) < 0)
{
/* What else can we do? */
diff --git a/grp/tst-putgrent.c b/grp/tst-putgrent.c
new file mode 100644
index 0000000..0a07ef6
--- /dev/null
+++ b/grp/tst-putgrent.c
@@ -0,0 +1,167 @@
+/* Test for processing of invalid group entries. [BZ #18724]
+ Copyright (C) 2015 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <errno.h>
+#include <grp.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static bool errors;
+
+static void
+check (struct group e, const char *expected)
+{
+ char *buf;
+ size_t buf_size;
+ FILE *f = open_memstream (&buf, &buf_size);
+
+ if (f == NULL)
+ {
+ printf ("open_memstream: %m\n");
+ errors = true;
+ return;
+ }
+
+ int ret = putgrent (&e, f);
+
+ if (expected == NULL)
+ {
+ if (ret == -1)
+ {
+ if (errno != EINVAL)
+ {
+ printf ("putgrent: unexpected error code: %m\n");
+ errors = true;
+ }
+ }
+ else
+ {
+ printf ("putgrent: unexpected success (\"%s\", \"%s\")\n",
+ e.gr_name, e.gr_passwd);
+ errors = true;
+ }
+ }
+ else
+ {
+ /* Expect success. */
+ size_t expected_length = strlen (expected);
+ if (ret == 0)
+ {
+ long written = ftell (f);
+
+ if (written <= 0 || fflush (f) < 0)
+ {
+ printf ("stream error: %m\n");
+ errors = true;
+ }
+ else if (buf[written - 1] != '\n')
+ {
+ printf ("FAILED: \"%s\" without newline\n", expected);
+ errors = true;
+ }
+ else if (strncmp (buf, expected, written - 1) != 0
+ || written - 1 != expected_length)
+ {
+ buf[written - 1] = '\0';
+ printf ("FAILED: \"%s\" (%ld), expected \"%s\" (%zu)\n",
+ buf, written - 1, expected, expected_length);
+ errors = true;
+ }
+ }
+ else
+ {
+ printf ("FAILED: putgrent (expected \"%s\"): %m\n", expected);
+ errors = true;
+ }
+ }
+
+ fclose (f);
+ free (buf);
+}
+
+static int
+do_test (void)
+{
+ check ((struct group) {
+ .gr_name = (char *) "root",
+ },
+ "root::0:");
+ check ((struct group) {
+ .gr_name = (char *) "root",
+ .gr_passwd = (char *) "password",
+ .gr_gid = 1234,
+ .gr_mem = (char *[2]) {(char *) "member1", NULL}
+ },
+ "root:password:1234:member1");
+ check ((struct group) {
+ .gr_name = (char *) "root",
+ .gr_passwd = (char *) "password",
+ .gr_gid = 1234,
+ .gr_mem = (char *[3]) {(char *) "member1", (char *) "member2", NULL}
+ },
+ "root:password:1234:member1,member2");
+
+ /* Bad values. */
+ {
+ static const char *const bad_strings[] = {
+ ":",
+ "\n",
+ ":bad",
+ "\nbad",
+ "b:ad",
+ "b\nad",
+ "bad:",
+ "bad\n",
+ "b:a\nd"
+ ",",
+ "\n,",
+ ":,",
+ ",bad",
+ "b,ad",
+ "bad,",
+ NULL
+ };
+ for (const char *const *bad = bad_strings; *bad != NULL; ++bad)
+ {
+ char *members[]
+ = {(char *) "first", (char *) *bad, (char *) "last", NULL};
+ if (strpbrk (*bad, ":\n") != NULL)
+ {
+ check ((struct group) {
+ .gr_name = (char *) *bad,
+ }, NULL);
+ check ((struct group) {
+ .gr_name = (char *) "root",
+ .gr_passwd = (char *) *bad,
+ }, NULL);
+ }
+ check ((struct group) {
+ .gr_name = (char *) "root",
+ .gr_passwd = (char *) "password",
+ .gr_mem = members,
+ }, NULL);
+ }
+ }
+
+ return errors;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"