mathieu/os-rust
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

change std::process to drop supplementary groups based on CAP_SETGID

Browse source
This commit is contained in:
Elliot Roberts 2022-04-12 07:46:07 -07:00 • committed by Pavel Grigorenko
parent 829308e9af
commit 3a6af84fca
No known key found for this signature in database
GPG key ID: 52BFCC6ED389F777
2 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
library/std/src/os/unix/process.rs
View file

@ -39,6 +39,13 @@ pub trait CommandExt: Sealed {
/// Sets the child process's user ID. This translates to a
/// `setuid` call in the child process. Failure in the `setuid`
/// call will cause the spawn to fail.
///
/// # Notes
///
/// This will also trigger a call to `setgroups(0, NULL)` in the child
/// process if no groups have been specified.
/// This removes supplementary groups that might have given the child
/// unwanted permissions.
#[stable(feature = "rust1", since = "1.0.0")]
fn uid(&mut self, id: UserId) -> &mut process::Command;

14
library/std/src/sys/pal/unix/process/process_unix.rs
View file

@ -330,14 +330,22 @@ impl Command {
if let Some(u) = self.get_uid() {
// When dropping privileges from root, the `setgroups` call
// will remove any extraneous groups. We only drop groups
// if the current uid is 0 and we weren't given an explicit
// if we have CAP_SETGID and we weren't given an explicit
// set of groups. If we don't call this, then even though our
// uid has dropped, we may still have groups that enable us to
// do super-user things.
//FIXME: Redox kernel does not support setgroups yet
#[cfg(not(target_os = "redox"))]
if libc::getuid() == 0 && self.get_groups().is_none() {
cvt(libc::setgroups(0, crate::ptr::null()))?;
if self.get_groups().is_none() {
let res = cvt(libc::setgroups(0, crate::ptr::null()));
if let Err(e) = res {
// Here we ignore the case of not having CAP_SETGID.
// An alternative would be to require CAP_SETGID (in
// addition to CAP_SETUID) for setting the UID.
if e.raw_os_error() != Some(libc::EPERM) {
return Err(e.into());
}
}
}
cvt(libc::setuid(u as uid_t))?;
}