isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed bad condition for sesh args

Browse Source 
In selinux_edit_copy_tfiles() when there is only one file and the open()
fails then number of arguments is lower than expected.
Sudo should return error with or without "Defaults !sudoedit_checkdir" set.

This was found with regression testing of CVE-2021-23240.

Signed-off-by: Radovan Sroka <rsroka@redhat.com>
This commit is contained in:
Radovan Sroka
2021-04-07 14:43:40 +02:00
committed by Todd C. Miller
parent 97f6fc259c
commit f44adcdf3c
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/sudo_edit.c
View File

@@ -529,6 +529,8 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
if (nfiles < 1) if (nfiles < 1)
debug_return_int(0); debug_return_int(0);
const int check_dir = ISSET(command_details->flags, CD_SUDOEDIT_CHECKDIR);
/* Construct common args for sesh */ /* Construct common args for sesh */
sesh_nargs = 5 + (nfiles * 2) + 1; sesh_nargs = 5 + (nfiles * 2) + 1;
sesh_args = sesh_ap = reallocarray(NULL, sesh_nargs, sizeof(char *)); sesh_args = sesh_ap = reallocarray(NULL, sesh_nargs, sizeof(char *));
@@ -538,7 +540,7 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
} }
*sesh_ap++ = "sesh"; *sesh_ap++ = "sesh";
*sesh_ap++ = "-e"; *sesh_ap++ = "-e";
if (ISSET(command_details->flags, CD_SUDOEDIT_CHECKDIR)) { if (check_dir) {
if ((user_str = selinux_fmt_sudo_user()) == NULL) { if ((user_str = selinux_fmt_sudo_user()) == NULL) {
sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory")); sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
goto done; goto done;
@@ -581,7 +583,11 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
if (tfd != -1) if (tfd != -1)
close(tfd); close(tfd);
if (sesh_ap - sesh_args > 3) { /*
* check dir adds two more args to the array
*/
if ((!check_dir && sesh_ap - sesh_args > 3)
|| (check_dir && sesh_ap - sesh_args > 5)) {
/* Run sesh -e 1 <t1> <o1> ... <tn> <on> */ /* Run sesh -e 1 <t1> <o1> ... <tn> <on> */
error = selinux_run_helper(command_details->cred.uid, command_details->cred.gid, error = selinux_run_helper(command_details->cred.uid, command_details->cred.gid,
command_details->cred.ngroups, command_details->cred.groups, sesh_args, command_details->cred.ngroups, command_details->cred.groups, sesh_args,