@@ -48,7 +48,7 @@ extern char* _mktemp(char*); /* mktemp doesn't link right. Don't ask me why. */
48
48
extern sqlite3 * database_init ();
49
49
extern int database_check (sqlite3 * , struct su_initiator * , struct su_request * );
50
50
51
- /* Not lazy anymore, just need these in too many places */
51
+ /* Still lazt, will fix this */
52
52
static char * socket_path = NULL ;
53
53
static sqlite3 * db = NULL ;
54
54
@@ -318,7 +318,8 @@ int main(int argc, char *argv[])
318
318
}
319
319
} else if (!strcmp (argv [i ], "-s" ) || !strcmp (argv [i ], "--shell" )) {
320
320
if (++ i < argc ) {
321
- strcpy (shell , argv [i ]);
321
+ strncpy (shell , argv [i ], sizeof (shell ));
322
+ shell [sizeof (shell ) - 1 ] = 0 ;
322
323
} else {
323
324
usage ();
324
325
}
@@ -351,9 +352,11 @@ int main(int argc, char *argv[])
351
352
}
352
353
}
353
354
354
- from_init (& su_from );
355
+ if (from_init (& su_from ) < 0 ) {
356
+ deny ();
357
+ }
355
358
356
- if (su_from .uid == AID_ROOT )
359
+ if (su_from .uid == AID_ROOT || su_from . uid == AID_SHELL )
357
360
allow (shell );
358
361
359
362
if (stat (REQUESTOR_DATA_PATH , & st ) < 0 ) {
@@ -370,14 +373,14 @@ int main(int argc, char *argv[])
370
373
371
374
req_uid = st .st_uid ;
372
375
373
- if (from_init (& su_from ) < 0 ) {
374
- deny ();
375
- }
376
-
377
376
if (mkdir (REQUESTOR_CACHE_PATH , 0771 ) >= 0 ) {
378
377
chown (REQUESTOR_CACHE_PATH , req_uid , req_uid );
379
378
}
380
379
380
+ setgroups (0 , NULL );
381
+ setegid (st .st_gid );
382
+ seteuid (st .st_uid );
383
+
381
384
LOGE ("sudb - Opening database" );
382
385
db = database_init ();
383
386
if (!db ) {
@@ -391,14 +394,15 @@ int main(int argc, char *argv[])
391
394
// Close the database, we're done with it. If it stays open,
392
395
// it will cause problems
393
396
sqlite3_close (db );
397
+ db = NULL ;
394
398
LOGE ("sudb - Database closed" );
395
399
}
396
400
397
401
switch (dballow ) {
398
- case DB_DENY : LOGE ( "denying" ); deny ();
399
- case DB_ALLOW : LOGE ( "allowing" ); allow (shell );
400
- case DB_INTERACTIVE : LOGE ( "asking" ); break ;
401
- default : LOGE ( "default, denying" ); deny ();
402
+ case DB_DENY : deny ();
403
+ case DB_ALLOW : allow (shell );
404
+ case DB_INTERACTIVE : break ;
405
+ default : deny ();
402
406
}
403
407
404
408
socket_serv_fd = socket_create_temp (req_uid );
0 commit comments