shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-07 17:17:44 +03:00
Code

core: warn if a generator is world-writable

Browse Source 
... because that is obviously a security risk.

(cherry picked from commit da32cac8a014ddf048fc7bad84dafdbc204d4dc8)
(cherry picked from commit 7ac58949a37db3ddb662908d3aadaf5934fec222)
(cherry picked from commit 3b0731b9d4)
(cherry picked from commit 7c72562c4d)
This commit is contained in:
Lukas Nykryn 2024-10-04 10:51:02 +02:00 committed by Luca Boccassi
parent 916fb2dcc8
commit d3683fffd6
3 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/manager.c
View File

@ -3826,7 +3826,7 @@ static int manager_execute_generators(Manager *m, char **paths, bool remount_ro)
/* callbacks= */ NULL, /* callback_args= */ NULL,
(char**) argv,
ge,
EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS | EXEC_DIR_SET_SYSTEMD_EXEC_PID);
EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS | EXEC_DIR_SET_SYSTEMD_EXEC_PID | EXEC_DIR_WARN_WORLD_WRITABLE);
}
static int manager_run_generators(Manager *m) {

12
src/shared/exec-util.c
View File

@ -149,6 +149,18 @@ static int do_execute(
log_debug("About to execute %s%s%s", t, argv ? " " : "", argv ? strnull(args) : "");
}
if (FLAGS_SET(flags, EXEC_DIR_WARN_WORLD_WRITABLE)) {
struct stat st;
r = stat(t, &st);
if (r < 0)
log_warning_errno(errno, "Failed to stat '%s', ignoring: %m", t);
else if (S_ISREG(st.st_mode) && (st.st_mode & 0002))
log_warning("'%s' is marked world-writable, which is a security risk as it "
"is executed with privileges. Please remove world writability "
"permission bits. Proceeding anyway.", t);
}
r = do_spawn(t, argv, fd, &pid, FLAGS_SET(flags, EXEC_DIR_SET_SYSTEMD_EXEC_PID));
if (r <= 0)
continue;

1
src/shared/exec-util.h
View File

@ -19,6 +19,7 @@ typedef enum {
EXEC_DIR_PARALLEL = 1 << 0, /* Execute scripts in parallel, if possible */
EXEC_DIR_IGNORE_ERRORS = 1 << 1, /* Ignore non-zero exit status of scripts */
EXEC_DIR_SET_SYSTEMD_EXEC_PID = 1 << 2, /* Set $SYSTEMD_EXEC_PID environment variable */
EXEC_DIR_WARN_WORLD_WRITABLE = 1 << 3, /* Warn if world writable files are found */
} ExecDirFlags;
typedef enum ExecCommandFlags {