2007-10-05 10:55:26 +02:00
|
|
|
#!/bin/sh
|
|
|
|
|
# A cross-partition move of a file in a sticky tmpdir and owned by
|
|
|
|
|
# someone else would evoke an invalid diagnostic:
|
2012-01-07 17:47:58 +01:00
|
|
|
# mv: cannot remove 'x': Operation not permitted
|
2007-10-05 10:55:26 +02:00
|
|
|
# Affects coreutils-6.0-6.9.
|
|
|
|
|
|
2026-01-01 10:56:16 -08:00
|
|
|
# Copyright (C) 2007-2026 Free Software Foundation, Inc.
|
2007-10-05 10:55:26 +02:00
|
|
|
|
|
|
|
|
# This program is free software: you can redistribute it and/or modify
|
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
# (at your option) any later version.
|
|
|
|
|
|
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
# You should have received a copy of the GNU General Public License
|
2017-09-19 01:13:23 -07:00
|
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
2007-10-05 10:55:26 +02:00
|
|
|
|
2012-09-02 21:55:12 +02:00
|
|
|
. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
|
2010-11-17 21:35:31 +01:00
|
|
|
print_ver_ mv
|
2007-12-08 12:29:25 +01:00
|
|
|
require_root_
|
2007-10-05 10:55:26 +02:00
|
|
|
|
|
|
|
|
cleanup_() { rm -rf "$other_partition_tmpdir"; }
|
2012-09-02 21:55:12 +02:00
|
|
|
. "$abs_srcdir/tests/other-fs-tmpdir"
|
2007-10-05 10:55:26 +02:00
|
|
|
|
|
|
|
|
# Set up to run a test where non-root user tries to move a root-owned
|
|
|
|
|
# file from a sticky tmpdir to a directory owned by that user on
|
|
|
|
|
# a different partition.
|
|
|
|
|
|
2011-08-04 20:52:31 +02:00
|
|
|
mkdir t || framework_failure_
|
|
|
|
|
chmod a=rwx,o+t t || framework_failure_
|
|
|
|
|
echo > t/root-owned || framework_failure_
|
|
|
|
|
chmod a+r t/root-owned || framework_failure_
|
|
|
|
|
chown "$NON_ROOT_USERNAME" "$other_partition_tmpdir" || framework_failure_
|
2007-10-05 10:55:26 +02:00
|
|
|
|
|
|
|
|
# We have to allow $NON_ROOT_USERNAME access to ".".
|
2011-08-04 20:52:31 +02:00
|
|
|
chmod go+x . || framework_failure_
|
2007-10-05 10:55:26 +02:00
|
|
|
|
2009-10-29 14:40:40 +01:00
|
|
|
|
2007-10-05 10:55:26 +02:00
|
|
|
# Ensure that $NON_ROOT_USERNAME can access the required version of mv.
|
2012-04-03 21:42:48 +02:00
|
|
|
version=$(
|
chroot: perform chdir("/") again unless new --skip-chdir is specified
Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall
for "/" arguments (and synonyms). The problem is that it also skips
the following chdir("/") call in that case. The latter breaks existing
scripts which expect "/" to be the working directory inside the chroot.
While the first part of the change - i.e., skipping chroot("/") - is
okay for consistency with systems where it might succeed for a non-root
user, the second part might be malicious, e.g.
cd /home/user && chroot '/' bin/foo
In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT,
but in the worst case, chroot(1) would execute '/home/user/bin/foo' in
the case that exists - instead of '/bin/foo'.
Revert that second part of the patch, i.e., perform the chdir("/)
in the common case again - unless the new --skip-chdir option is
specified. Restrict this new option to the case of "/" arguments.
* src/chroot.c (SKIP_CHDIR): Add enum.
(long_opts): Add entry for the new --skip-chdir option.
(usage): Add --skip-chdir option, and while at it, move the other
to options into alphabetical order.
(main): Accept the above new option, allowing it only in the case
when NEWROOT is the old "/".
Move down the chdir() call after the if-clause to ensure it is
run in any case - unless --skip-chdir is specified.
Add a 'newroot' variable for the new root directory as it is used
in a couple of places now.
* tests/misc/chroot-fail.sh: Invert the last tests which check the
working directory of the execvp()ed program when a "/"-like
argument was passed: now expect it to be "/" - unless --skip-chdir
is given.
* doc/coreutils.texi (chroot invocation): Document the new option.
Document that chroot(1) usually calls chdir("/") unless the new
--skip-chdir option is specified. Sort options.
* NEWS (Changes in behavior): Mention the fix.
(New features): Mention the new option.
* init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option.
* tests/cp/preserve-gid.sh (t1): Likewise.
* tests/cp/special-bits.sh: Likewise.
* tests/id/setgid.sh: Likewise.
* tests/misc/truncate-owned-by-other.sh: Likewise.
* tests/mv/sticky-to-xpart.sh: Likewise.
* tests/rm/fail-2eperm.sh: Likewise.
* tests/rm/no-give-up.sh: Likewise.
* tests/touch/now-owned-by-other.sh: Likewise.
Reported by Andreas Schwab in http://bugs.gnu.org/18062
2014-08-01 02:07:33 +02:00
|
|
|
chroot --skip-chdir --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
|
|
|
|
|
mv --version |
|
coreutils: keep lines within 80-column limits
* cfg.mk (LINE_LEN_MAX, FILTER_LONG_LINES): New macros.
(sc_long_lines): New rule.
* HACKING: Use shorter URLs to the same material.
* doc/Makefile.am, doc/coreutils.texi, m4/boottime.m4:
* man/help2man, man/stdbuf.x, src/Makefile.am, src/cat.c, src/copy.c:
* src/cp.c, src/dd.c, src/df.c, src/du.c, src/groups.c, src/install.c:
* src/ls.c, src/md5sum.c, src/mv.c, src/od.c, src/pinky.c, src/ptx.c:
* src/readlink.c, src/remove.c, src/rmdir.c, src/setuidgid.c:
* src/sort.c, src/tail.c, src/touch.c, tests/Coreutils.pm:
* tests/cp/existing-perm-race, tests/cp/perm, tests/cp/preserve-gid:
* tests/du/2g, tests/du/long-from-unreadable, tests/init.sh:
* tests/install/basic-1, tests/ls/nameless-uid:
* tests/ls/readdir-mountpoint-inode, tests/misc/chroot-credentials:
* tests/misc/cut, tests/misc/date, tests/misc/join, tests/misc/md5sum:
* tests/misc/sha1sum, tests/misc/sha224sum, tests/misc/sort:
* tests/misc/sort-continue, tests/misc/sort-files0-from:
* tests/misc/sort-rand, tests/misc/stdbuf, tests/misc/tr:
* tests/misc/uniq, tests/mv/atomic, tests/mv/part-fail:
* tests/mv/part-symlink, tests/mv/sticky-to-xpart, tests/pr/pr-tests:
* tests/rm/fail-2eperm, tests/rm/interactive-always:
Reformat to fit within 80 columns.
* doc/Makefile.am (BAD_POSIX_PERL): New macro.
* doc/coreutils.texi: Reword slightly, to make menus and
index lines shorter.
* src/md5sum.c: Redo --help output so that it fits within 79
columns, since that's a bit more portable and all the other --help
strings fit in 79 columns.
2010-12-28 12:28:48 -08:00
|
|
|
sed -n '1s/.* //p'
|
2012-04-03 21:42:48 +02:00
|
|
|
)
|
2007-10-05 10:55:26 +02:00
|
|
|
case $version in
|
|
|
|
|
$PACKAGE_VERSION) ;;
|
2011-06-14 16:22:41 +02:00
|
|
|
*) skip_ "cannot access just-built mv as user $NON_ROOT_USERNAME";;
|
2007-10-05 10:55:26 +02:00
|
|
|
esac
|
|
|
|
|
|
chroot: perform chdir("/") again unless new --skip-chdir is specified
Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall
for "/" arguments (and synonyms). The problem is that it also skips
the following chdir("/") call in that case. The latter breaks existing
scripts which expect "/" to be the working directory inside the chroot.
While the first part of the change - i.e., skipping chroot("/") - is
okay for consistency with systems where it might succeed for a non-root
user, the second part might be malicious, e.g.
cd /home/user && chroot '/' bin/foo
In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT,
but in the worst case, chroot(1) would execute '/home/user/bin/foo' in
the case that exists - instead of '/bin/foo'.
Revert that second part of the patch, i.e., perform the chdir("/)
in the common case again - unless the new --skip-chdir option is
specified. Restrict this new option to the case of "/" arguments.
* src/chroot.c (SKIP_CHDIR): Add enum.
(long_opts): Add entry for the new --skip-chdir option.
(usage): Add --skip-chdir option, and while at it, move the other
to options into alphabetical order.
(main): Accept the above new option, allowing it only in the case
when NEWROOT is the old "/".
Move down the chdir() call after the if-clause to ensure it is
run in any case - unless --skip-chdir is specified.
Add a 'newroot' variable for the new root directory as it is used
in a couple of places now.
* tests/misc/chroot-fail.sh: Invert the last tests which check the
working directory of the execvp()ed program when a "/"-like
argument was passed: now expect it to be "/" - unless --skip-chdir
is given.
* doc/coreutils.texi (chroot invocation): Document the new option.
Document that chroot(1) usually calls chdir("/") unless the new
--skip-chdir option is specified. Sort options.
* NEWS (Changes in behavior): Mention the fix.
(New features): Mention the new option.
* init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option.
* tests/cp/preserve-gid.sh (t1): Likewise.
* tests/cp/special-bits.sh: Likewise.
* tests/id/setgid.sh: Likewise.
* tests/misc/truncate-owned-by-other.sh: Likewise.
* tests/mv/sticky-to-xpart.sh: Likewise.
* tests/rm/fail-2eperm.sh: Likewise.
* tests/rm/no-give-up.sh: Likewise.
* tests/touch/now-owned-by-other.sh: Likewise.
Reported by Andreas Schwab in http://bugs.gnu.org/18062
2014-08-01 02:07:33 +02:00
|
|
|
chroot --skip-chdir --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
|
2009-08-30 01:27:45 +01:00
|
|
|
mv t/root-owned "$other_partition_tmpdir" 2> out-t && fail=1
|
2007-10-05 10:55:26 +02:00
|
|
|
|
2012-01-07 17:47:58 +01:00
|
|
|
# On some systems, we get 'Not owner'. Convert it.
|
|
|
|
|
# On other systems (HPUX), we get 'Permission denied'. Convert it, too.
|
2007-10-05 10:55:26 +02:00
|
|
|
onp='Operation not permitted'
|
|
|
|
|
sed "s/Not owner/$onp/;s/Permission denied/$onp/" out-t > out
|
|
|
|
|
|
2025-03-23 12:00:31 -07:00
|
|
|
# On some systems (OpenBSD 7.5), the initial rename fails with EPERM,
|
|
|
|
|
# which is arguably better than the Linux kernel's EXDEV.
|
|
|
|
|
cat <<EOF >exp1 || framework_failure_
|
|
|
|
|
mv: cannot move 't/root-owned' to '$other_partition_tmpdir/root-owned': $onp
|
2007-10-05 10:55:26 +02:00
|
|
|
EOF
|
|
|
|
|
|
2025-03-23 12:00:31 -07:00
|
|
|
compare exp1 out >/dev/null || {
|
|
|
|
|
|
|
|
|
|
cat <<EOF >exp || framework_failure_
|
|
|
|
|
mv: cannot remove 't/root-owned': $onp
|
|
|
|
|
EOF
|
|
|
|
|
|
|
|
|
|
compare exp out || fail=1
|
|
|
|
|
}
|
2007-10-05 10:55:26 +02:00
|
|
|
|
2008-09-07 10:31:27 +02:00
|
|
|
Exit $fail
|