mirror of
git://git.sv.gnu.org/coreutils.git
synced 2026-02-23 23:56:08 +02:00
0cf7b1d928
Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall
for "/" arguments (and synonyms). The problem is that it also skips
the following chdir("/") call in that case. The latter breaks existing
scripts which expect "/" to be the working directory inside the chroot.
While the first part of the change - i.e., skipping chroot("/") - is
okay for consistency with systems where it might succeed for a non-root
user, the second part might be malicious, e.g.
cd /home/user && chroot '/' bin/foo
In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT,
but in the worst case, chroot(1) would execute '/home/user/bin/foo' in
the case that exists - instead of '/bin/foo'.
Revert that second part of the patch, i.e., perform the chdir("/)
in the common case again - unless the new --skip-chdir option is
specified. Restrict this new option to the case of "/" arguments.
* src/chroot.c (SKIP_CHDIR): Add enum.
(long_opts): Add entry for the new --skip-chdir option.
(usage): Add --skip-chdir option, and while at it, move the other
to options into alphabetical order.
(main): Accept the above new option, allowing it only in the case
when NEWROOT is the old "/".
Move down the chdir() call after the if-clause to ensure it is
run in any case - unless --skip-chdir is specified.
Add a 'newroot' variable for the new root directory as it is used
in a couple of places now.
* tests/misc/chroot-fail.sh: Invert the last tests which check the
working directory of the execvp()ed program when a "/"-like
argument was passed: now expect it to be "/" - unless --skip-chdir
is given.
* doc/coreutils.texi (chroot invocation): Document the new option.
Document that chroot(1) usually calls chdir("/") unless the new
--skip-chdir option is specified. Sort options.
* NEWS (Changes in behavior): Mention the fix.
(New features): Mention the new option.
* init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option.
* tests/cp/preserve-gid.sh (t1): Likewise.
* tests/cp/special-bits.sh: Likewise.
* tests/id/setgid.sh: Likewise.
* tests/misc/truncate-owned-by-other.sh: Likewise.
* tests/mv/sticky-to-xpart.sh: Likewise.
* tests/rm/fail-2eperm.sh: Likewise.
* tests/rm/no-give-up.sh: Likewise.
* tests/touch/now-owned-by-other.sh: Likewise.
Reported by Andreas Schwab in http://bugs.gnu.org/18062
64 lines
2.2 KiB
Bash
Executable File
64 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# Verify that internal failure in chroot gives exact status.
|
|
|
|
# Copyright (C) 2009-2014 Free Software Foundation, Inc.
|
|
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
|
|
print_ver_ chroot
|
|
|
|
require_built_ chroot
|
|
|
|
# These tests verify exact status of internal failure; since none of
|
|
# them actually run a command, we don't need root privileges
|
|
chroot # missing argument
|
|
test $? = 125 || fail=1
|
|
chroot --- / true # unknown option
|
|
test $? = 125 || fail=1
|
|
|
|
# Note chroot("/") succeeds for non-root users on some systems, but not all,
|
|
# however we avoid the chroot() with "/" to have common behavior.
|
|
chroot / sh -c 'exit 2' # exit status propagation
|
|
test $? = 2 || fail=1
|
|
chroot / . # invalid command
|
|
test $? = 126 || fail=1
|
|
chroot / no_such # no such command
|
|
test $? = 127 || fail=1
|
|
|
|
# Ensure that --skip-chdir fails with a non-"/" argument.
|
|
cat <<\EOF > exp || framework_failure_
|
|
chroot: option --skip-chdir only permitted if NEWROOT is old '/'
|
|
Try 'chroot --help' for more information.
|
|
EOF
|
|
chroot --skip-chdir . env pwd >out 2>err && fail=1
|
|
compare /dev/null out || fail=1
|
|
compare exp err || fail=1
|
|
|
|
# Ensure we don't chroot("/") when NEWROOT is old "/".
|
|
ln -s / isroot || framework_failure_
|
|
for dir in '/' '/.' '/../' isroot; do
|
|
# Verify that chroot(1) succeeds and performs chdir("/")
|
|
# (chroot(1) of coreutils-8.23 failed to run the latter).
|
|
curdir=$(chroot "$dir" env pwd) || fail=1
|
|
test "$curdir" = '/' || fail=1
|
|
|
|
# Test the "--skip-chdir" option.
|
|
curdir=$(chroot --skip-chdir "$dir" env pwd) || fail=1
|
|
test "$curdir" = '/' && fail=1
|
|
done
|
|
|
|
Exit $fail
|