commit a8aa9f3fd4e6a6e53be4dc8429f4bf876715cda7 · pyrox.dev/nixpkgs

+6 -6
nixos/modules/security/setuid-wrapper.c
···

       31
       31
        
              false `X.real' file, to allow arbitrary programs from being

     

       32
       32
        
              executed setuid.  */

     

       33
       33
        
           assert ((strncmp(self, wrapperDir, sizeof(wrapperDir)) == 0) &&

     

       34
       34
       -
       	    (self[strlen(wrapperDir)] == '/'));

     

       34
       34
       +
                   (self[strlen(wrapperDir)] == '/'));

     

       35
       35
        
       

     

       36
       36
        
           /* Make *really* *really* sure that we were executed as `self',

     

       37
       37
        
              and not, say, as some other setuid program.  That is, our

     
···

       42
       42
        
           assert (lstat(self, &st) != -1);

     

       43
       43
        
       

     

       44
       44
        
           //printf("%d %d\n", st.st_uid, st.st_gid);

     

       45
       45
       -
           

     

       45
       45
       +
       

     

       46
       46
        
           assert ((st.st_mode & S_ISUID) == 0 ||

     

       47
       47
       -
       	    (st.st_uid == geteuid()));

     

       47
       47
       +
                   (st.st_uid == geteuid()));

     

       48
       48
        
       

     

       49
       49
        
           assert ((st.st_mode & S_ISGID) == 0 ||

     

       50
       50
       -
       	    st.st_gid == getegid());

     

       50
       50
       +
                   st.st_gid == getegid());

     

       51
       51
        
       

     

       52
       52
        
           /* And, of course, we shouldn't be writable. */

     

       53
       53
        
           assert (!(st.st_mode & (S_IWGRP | S_IWOTH)));

     
···

       69
       69
        
           real[len] = 0;

     

       70
       70
        
       

     

       71
       71
        
           close(fdSelf);

     

       72
       72
       -
           

     

       72
       72
       +
       

     

       73
       73
        
           //printf("real = %s, len = %d\n", real, len);

     

       74
       74
        
       

     

       75
       75
        
           execve(real, argv, environ);

     

       76
       76
        
       

     

       77
       77
        
           fprintf(stderr, "%s: cannot run `%s': %s\n",

     

       78
       78
        
               argv[0], real, strerror(errno));

     

       79
       79
       -
           

     

       79
       79
       +
       

     

       80
       80
        
           exit(1);

     

       81
       81
        
       }