Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
[systemd] Fix CVE-2019-3842. Fixes JB#46845
This is the backport of upstream commit systemd/systemd@83d4ab5 From 83d4ab55336ff8a0643c6aa627b31e351a24040a Mon Sep 17 00:00:00 2001 From: Lennart Poettering <lennart@poettering.net> Date: Mon, 4 Feb 2019 10:23:43 +0100 Subject: [PATCH] pam-systemd: use secure_getenv() rather than getenv() Signed-off-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
- Loading branch information
Showing
2 changed files
with
61 additions
and
0 deletions.
There are no files selected for viewing
59 changes: 59 additions & 0 deletions
59
rpm/systemd-backport-pam-systemd-use-secure_getenv-rather-than-getenv.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
This is the backport of upstream commit | ||
https://github.com/systemd/systemd/commit/83d4ab55336ff8a0643c6aa627b31e351a24040a | ||
|
||
It fixes CVE-2019-3842. | ||
|
||
From 83d4ab55336ff8a0643c6aa627b31e351a24040a Mon Sep 17 00:00:00 2001 | ||
From: Lennart Poettering <lennart@poettering.net> | ||
Date: Mon, 4 Feb 2019 10:23:43 +0100 | ||
Subject: [PATCH] pam-systemd: use secure_getenv() rather than getenv() | ||
|
||
diff -purN systemd/src/login/pam_systemd.c systemd-izh/src/login/pam_systemd.c | ||
--- systemd/src/login/pam_systemd.c 2019-08-05 05:38:44.107368495 -0400 | ||
+++ systemd-izh/src/login/pam_systemd.c 2019-08-05 14:00:21.968726200 -0400 | ||
@@ -284,29 +284,40 @@ _public_ PAM_EXTERN int pam_sm_open_sess | ||
pam_get_item(handle, PAM_RUSER, (const void**) &remote_user); | ||
pam_get_item(handle, PAM_RHOST, (const void**) &remote_host); | ||
|
||
+ /* Looks for an environment variable, preferrably in the environment block associated with the | ||
+ * specified PAM handle, falling back to the process' block instead. Why check both? Because we want | ||
+ * to permit configuration of session properties from unit files that invoke PAM services, so that | ||
+ * PAM services don't have to be reworked to set systemd-specific properties, but these properties | ||
+ * can still be set from the unit file Environment= block. | ||
+ * | ||
+ * We use secure_getenv() here, since we might get loaded into su/sudo, which are SUID. Ideally | ||
+ * they'd clean up the environment before invoking foreign code (such as PAM modules), but alas they | ||
+ * currently don't (to be precise, they clean up the environment they pass to their children, but | ||
+ * not their own environ[]). */ | ||
+ | ||
seat = pam_getenv(handle, "XDG_SEAT"); | ||
if (isempty(seat)) | ||
- seat = getenv("XDG_SEAT"); | ||
+ seat = secure_getenv("XDG_SEAT"); | ||
|
||
cvtnr = pam_getenv(handle, "XDG_VTNR"); | ||
if (isempty(cvtnr)) | ||
- cvtnr = getenv("XDG_VTNR"); | ||
+ cvtnr = secure_getenv("XDG_VTNR"); | ||
|
||
type = pam_getenv(handle, "XDG_SESSION_TYPE"); | ||
if (isempty(type)) | ||
- type = getenv("XDG_SESSION_TYPE"); | ||
+ type = secure_getenv("XDG_SESSION_TYPE"); | ||
if (isempty(type)) | ||
type = type_pam; | ||
|
||
class = pam_getenv(handle, "XDG_SESSION_CLASS"); | ||
if (isempty(class)) | ||
- class = getenv("XDG_SESSION_CLASS"); | ||
+ class = secure_getenv("XDG_SESSION_CLASS"); | ||
if (isempty(class)) | ||
class = class_pam; | ||
|
||
desktop = pam_getenv(handle, "XDG_SESSION_DESKTOP"); | ||
if (isempty(desktop)) | ||
- desktop = getenv("XDG_SESSION_DESKTOP"); | ||
+ desktop = secure_getenv("XDG_SESSION_DESKTOP"); | ||
|
||
tty = strempty(tty); | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters