isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid using vfork(2) in the DSO system(3) wrapper.

Browse Source 
Traditional vfork(2) semantics make it unsafe for use for more than
just vfork(2) + execve(2).
This commit is contained in:
Todd C. Miller
2022-06-03 09:43:34 -06:00
parent 06bf1be67c
commit 25a26f5042
4 changed files with 2 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config.h.in
View File

@@ -1021,9 +1021,6 @@
/* Define to 1 if you have the `va_copy' function. */ /* Define to 1 if you have the `va_copy' function. */
#undef HAVE_VA_COPY #undef HAVE_VA_COPY
/* Define to 1 if you have the `vfork' function. */
#undef HAVE_VFORK
/* Define to 1 if you have the `vsnprintf' function. */ /* Define to 1 if you have the `vsnprintf' function. */
#undef HAVE_VSNPRINTF #undef HAVE_VSNPRINTF

2
configure vendored
View File

@@ -3261,7 +3261,6 @@ as_fn_append ac_func_c_list " faccessat HAVE_FACCESSAT"
as_fn_append ac_func_c_list " wordexp HAVE_WORDEXP" as_fn_append ac_func_c_list " wordexp HAVE_WORDEXP"
as_fn_append ac_func_c_list " getauxval HAVE_GETAUXVAL" as_fn_append ac_func_c_list " getauxval HAVE_GETAUXVAL"
as_fn_append ac_func_c_list " strtoull HAVE_STRTOULL" as_fn_append ac_func_c_list " strtoull HAVE_STRTOULL"
as_fn_append ac_func_c_list " vfork HAVE_VFORK"
as_fn_append ac_func_c_list " seteuid HAVE_SETEUID" as_fn_append ac_func_c_list " seteuid HAVE_SETEUID"
# Auxiliary files required by this configure script. # Auxiliary files required by this configure script.
@@ -21260,7 +21259,6 @@ done
for ac_func in execvpe for ac_func in execvpe
do : do :
ac_fn_c_check_func "$LINENO" "execvpe" "ac_cv_func_execvpe" ac_fn_c_check_func "$LINENO" "execvpe" "ac_cv_func_execvpe"

2
configure.ac
View File

@@ -2605,7 +2605,7 @@ dnl Function checks
dnl dnl
AC_FUNC_GETGROUPS AC_FUNC_GETGROUPS
AC_FUNC_FSEEKO AC_FUNC_FSEEKO
AC_CHECK_FUNCS_ONCE([fexecve fmemopen killpg nl_langinfo faccessat wordexp getauxval strtoull vfork]) AC_CHECK_FUNCS_ONCE([fexecve fmemopen killpg nl_langinfo faccessat wordexp getauxval strtoull])
AC_CHECK_FUNCS([execvpe], [SUDO_APPEND_INTERCEPT_EXP(execvpe)]) AC_CHECK_FUNCS([execvpe], [SUDO_APPEND_INTERCEPT_EXP(execvpe)])
AC_CHECK_FUNCS([pread], [ AC_CHECK_FUNCS([pread], [
# pread/pwrite on 32-bit HP-UX 11.x may not support large files # pread/pwrite on 32-bit HP-UX 11.x may not support large files

6
src/sudo_intercept.c
View File

@@ -52,10 +52,6 @@
#include "sudo_util.h" #include "sudo_util.h"
#include "pathnames.h" #include "pathnames.h"
#ifndef HAVE_VFORK
# define vfork fork
#endif
/* execl flavors */ /* execl flavors */
#define SUDO_EXECL 0x0 #define SUDO_EXECL 0x0
#define SUDO_EXECLE 0x1 #define SUDO_EXECLE 0x1
@@ -249,7 +245,7 @@ system_wrapper(const char *cmnd)
if (sigprocmask(SIG_BLOCK, &mask, &omask) == -1) if (sigprocmask(SIG_BLOCK, &mask, &omask) == -1)
debug_return_int(-1); debug_return_int(-1);
switch (child = vfork()) { switch (child = fork()) {
case -1: case -1:
/* error */ /* error */
(void)sigprocmask(SIG_SETMASK, &omask, NULL); (void)sigprocmask(SIG_SETMASK, &omask, NULL);