From 9cfed7116a745bc73d58df71c3e762c1f1ee15f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Honza=20Hor=C3=A1k?= Date: Tue, 2 Aug 2011 11:48:25 +0200 Subject: [PATCH] moved privileges drop after port reservation to handle a bug similar to #247985 --- netkit-rwall-0.17-droppriv.patch | 47 ++++++++++++++++++++++++++++++++ rwall.spec | 30 +++++++++++--------- rwalld.init | 4 +-- 3 files changed, 66 insertions(+), 15 deletions(-) create mode 100644 netkit-rwall-0.17-droppriv.patch diff --git a/netkit-rwall-0.17-droppriv.patch b/netkit-rwall-0.17-droppriv.patch new file mode 100644 index 0000000..9159aa6 --- /dev/null +++ b/netkit-rwall-0.17-droppriv.patch @@ -0,0 +1,47 @@ +diff -up netkit-rwall-0.17/rpc.rwalld/rwalld.c.debug netkit-rwall-0.17/rpc.rwalld/rwalld.c +--- netkit-rwall-0.17/rpc.rwalld/rwalld.c.debug 2011-08-01 15:22:08.886396602 +0200 ++++ netkit-rwall-0.17/rpc.rwalld/rwalld.c 2011-08-01 15:22:08.901396602 +0200 +@@ -90,20 +90,6 @@ main(int argc, char *argv[]) + exit(1); + } + +- if (getuid() == 0 || geteuid() == 0) { +- struct passwd *pwd = getpwnam("nobody"); +- if (pwd) { +- initgroups(pwd->pw_name, pwd->pw_gid); +- setgid(pwd->pw_gid); +- setuid(pwd->pw_uid); +- } +- seteuid(0); /* this should fail */ +- if (getuid() == 0 || geteuid() == 0) { +- syslog(LOG_CRIT, "can't drop root privileges"); +- exit(1); +- } +- } +- + /* + * See if inetd started us + */ +@@ -153,6 +139,22 @@ main(int argc, char *argv[]) + (void)fprintf(stderr, "unable to register (WALLPROG, WALLVERS, udp).\n"); + exit(1); + } ++ ++ /* Drop privilege */ ++ if (getuid() == 0 || geteuid() == 0) { ++ struct passwd *pwd = getpwnam("nobody"); ++ if (pwd) { ++ initgroups(pwd->pw_name, pwd->pw_gid); ++ setgid(pwd->pw_gid); ++ setuid(pwd->pw_uid); ++ } ++ seteuid(0); /* this should fail */ ++ if (getuid() == 0 || geteuid() == 0) { ++ syslog(LOG_CRIT, "can't drop root privileges"); ++ exit(1); ++ } ++ } ++ + svc_run(); + (void)fprintf(stderr, "svc_run returned\n"); + exit(1); diff --git a/rwall.spec b/rwall.spec index 6ea5937..d5c2aa2 100644 --- a/rwall.spec +++ b/rwall.spec @@ -1,14 +1,16 @@ -Summary: Client for sending messages to a host's logged in users. +Summary: Client for sending messages to a host's logged in users Name: rwall Version: 0.17 -Release: 31%{?dist} +Release: 32%{?dist} License: BSD +Url: ftp://ftp.linux.org.uk/pub/linux/Networking/netkit/ Group: System Environment/Daemons -Source: ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/netkit-rwall-%{version}.tar.gz +Source: ftp://ftp.linux.org.uk/pub/linux/Networking/netkit/netkit-rwall-%{version}.tar.gz Source1: rwalld.init Patch1: netkit-rwalld-0.10-banner.patch Patch2: netkit-rwall-0.17-strip.patch Patch3: netkit-rwall-0.17-netgroup.patch +Patch4: netkit-rwall-0.17-droppriv.patch BuildRoot: %{_tmppath}/%{name}-root %description @@ -22,9 +24,9 @@ Install rwall if you'd like the ability to send messages to users logged in to a specified host machine. %package server -Summary: Server for sending messages to a host's logged in users. -Prereq: /sbin/chkconfig /etc/init.d +Summary: Server for sending messages to a host's logged in users Group: System Environment/Daemons +Requires(pre): /sbin/chkconfig /etc/init.d Requires: portmap %description server @@ -42,6 +44,7 @@ from users on remote hosts. %patch1 -p1 -b .banner %patch2 -p1 -b .strip %patch3 -p1 -b .netgroup +%patch4 -p1 -b .droppriv %build sh configure --with-c-compiler=gcc @@ -67,17 +70,13 @@ sh configure --with-c-compiler=gcc make RPM_OPT_FLAGS="$RPM_OPT_FLAGS" %install -rm -rf ${RPM_BUILD_ROOT} mkdir -p ${RPM_BUILD_ROOT}%{_bindir} mkdir -p ${RPM_BUILD_ROOT}%{_sbindir} mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/man{1,8} mkdir -p ${RPM_BUILD_ROOT}/etc/rc.d/init.d make INSTALLROOT=${RPM_BUILD_ROOT} install -install -m 755 $RPM_SOURCE_DIR/rwalld.init ${RPM_BUILD_ROOT}/etc/rc.d/init.d/rwalld - -%clean -rm -rf ${RPM_BUILD_ROOT} +install -m 755 %SOURCE1 ${RPM_BUILD_ROOT}%{_initrddir}/rwalld %post server /sbin/chkconfig --add rwalld @@ -97,9 +96,14 @@ fi %{_sbindir}/rpc.rwalld %{_mandir}/man8/rpc.rwalld.8* %{_mandir}/man8/rwalld.8* -%config /etc/rc.d/init.d/rwalld +%{_initrddir}/rwalld %changelog +* Mon Aug 01 2011 Honza Horak - 0.17-32 +- moved privileges drop after port reservation to handle + a bug similar to #247985 +- fixed rpmlint errors + * Wed Feb 09 2011 Fedora Release Engineering - 0.17-31 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild @@ -213,7 +217,7 @@ fi - compress man pages. * Sat Feb 5 2000 Florian La Roche -- change %postun to %preun +- change %%postun to %%preun * Wed Feb 02 2000 Cristian Gafton - fix descriptions and summary @@ -246,7 +250,7 @@ fi * Sun Oct 19 1997 Erik Troan - added a chkconfig compatible initscript -- added %attr attributes +- added %%attr attributes * Tue Jul 15 1997 Erik Troan - initial build diff --git a/rwalld.init b/rwalld.init index 20f1a82..e4455d6 100755 --- a/rwalld.init +++ b/rwalld.init @@ -8,8 +8,8 @@ ### BEGIN INIT INFO # Provides: rpc.rwalld -# Required-Start: $syslog $network -# Required-Stop: $syslog $network +# Required-Start: $syslog $network $rpcbind +# Required-Stop: $syslog $network $rpcbind # Default-Start: # Default-Stop: 0 1 2 3 4 5 6 # Short-Description: start and stop rpc.rwalld