isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

On Solaris, disabling the proc_exec privilege appears to interfere

Browse Source 
with DAC file permissions.  Adding DAC override permissions to the
inheritable set works around this for commands run as root without
giving extra permissions to other users.  Bug #626
This commit is contained in:
Todd C. Miller
2013-12-02 11:14:25 -07:00
parent 0d81263e26
commit b082a614f5
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/exec_common.c
View File

@@ -65,6 +65,9 @@ disable_execute(char *const envp[])
#ifdef HAVE_PRIV_SET #ifdef HAVE_PRIV_SET
/* Solaris privileges, remove PRIV_PROC_EXEC post-execve. */ /* Solaris privileges, remove PRIV_PROC_EXEC post-execve. */
(void)priv_set(PRIV_ON, PRIV_INHERITABLE, "PRIV_FILE_DAC_READ", NULL);
(void)priv_set(PRIV_ON, PRIV_INHERITABLE, "PRIV_FILE_DAC_WRITE", NULL);
(void)priv_set(PRIV_ON, PRIV_INHERITABLE, "PRIV_FILE_DAC_SEARCH", NULL);
if (priv_set(PRIV_OFF, PRIV_LIMIT, "PRIV_PROC_EXEC", NULL) == 0) if (priv_set(PRIV_OFF, PRIV_LIMIT, "PRIV_PROC_EXEC", NULL) == 0)
debug_return_ptr(envp); debug_return_ptr(envp);
warning(U_("unable to remove PRIV_PROC_EXEC from PRIV_LIMIT")); warning(U_("unable to remove PRIV_PROC_EXEC from PRIV_LIMIT"));