5.30.0 - Unable to set supplementary group IDs #17031
Comments
From manuel-perl@mausz.atCreated by manuel-perl@mausz.atIn perl 5.30 it's impossible to set supplementary group IDs as the group This is due to the fact that Perl_grok_atoUV has been changed so endptr As this might leave processes with extended privileges I've marked this See #21 Perl Info |
From manuel-perl@mausz.atsupgroups.patchFrom d11fa967a3d74bc5530225a05f31f4065dfcec2f Mon Sep 17 00:00:00 2001
From: Manuel Mausz <manuel@mausz.at>
Date: Sun, 2 Jun 2019 19:02:37 +0000
Subject: [PATCH] mg.c reset endptr after use
Perl_grok_atoUV has been changed so endptr constraints the input. Thus we need to reset the endptr after every use.
---
mg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mg.c b/mg.c
index f4783fb68ae..3fe72c89e16 100644
--- a/mg.c
+++ b/mg.c
@@ -3178,7 +3178,8 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
{
const char *p = SvPV_const(sv, len);
Groups_t *gary = NULL;
- const char* endptr = p + len;
+ const char* p_end = p + len;
+ const char* endptr = p_end;
UV uv;
#ifdef _SC_NGROUPS_MAX
int maxgrp = sysconf(_SC_NGROUPS_MAX);
@@ -3201,6 +3202,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
if (endptr == NULL)
break;
p = endptr;
+ endptr = p_end;
while (isSPACE(*p))
++p;
if (!*p)
|
From @jkeenanOn Mon, 03 Jun 2019 12:52:50 GMT, manuel-perl@mausz.at wrote:
Could you provide a brief example of how, previously, you would have expected to be able to set these supplementary grou IDs? Thank you very much. -- |
|
The RT System itself - Status changed from 'new' to 'open' |
From @khwilliamsonOn 6/3/19 2:46 PM, James E Keenan via RT wrote:
Could you submit a patch against blead? We also need a test. The github repository is only a mirror, and is supposed to not be able |
From @LeontOn Mon, Jun 3, 2019 at 10:46 PM James E Keenan via RT
Supplementary GIDs can be set using $), as documented in perlvar. Leon |
From manuel@mausz.atI've now replied two times and neither message got attached to this ticket. In case they do pop up some time later please ignore them :-) On Mon, 03 Jun 2019 13:46:11 -0700, jkeenan wrote:
A quick example is:
This should add the "users" group to your current supplementary groups. On Linux you need CAP_SETGID capability (or root) for this to work. On Mon, 03 Jun 2019 14:40:28 -0700, public@khwilliamson.com wrote:
Attached is both my original patch against HEAD and a test I quickly |
From manuel@mausz.at0001-perl-134169-mg.c-reset-endptr-after-use.patchFrom 33608edc013d25ef0683f3ef37ca60d34210045a Mon Sep 17 00:00:00 2001
From: Manuel Mausz <manuel@mausz.at>
Date: Tue, 4 Jun 2019 00:29:09 +0200
Subject: [PATCH 1/2] (perl #134169) mg.c reset endptr after use
Perl_grok_atoUV has been changed so endptr constraints the input. Thus we need to reset the endptr after every use.
---
mg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mg.c b/mg.c
index f4783fb68a..3fe72c89e1 100644
--- a/mg.c
+++ b/mg.c
@@ -3178,7 +3178,8 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
{
const char *p = SvPV_const(sv, len);
Groups_t *gary = NULL;
- const char* endptr = p + len;
+ const char* p_end = p + len;
+ const char* endptr = p_end;
UV uv;
#ifdef _SC_NGROUPS_MAX
int maxgrp = sysconf(_SC_NGROUPS_MAX);
@@ -3201,6 +3202,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
if (endptr == NULL)
break;
p = endptr;
+ endptr = p_end;
while (isSPACE(*p))
++p;
if (!*p)
--
2.21.0
|
From manuel@mausz.at0002-Add-test-for-perl-134169.patchFrom 8ae3c50c17cbd25c745438f23d7bef0c8a2496b3 Mon Sep 17 00:00:00 2001
From: Manuel Mausz <manuel@mausz.at>
Date: Tue, 4 Jun 2019 00:29:22 +0200
Subject: [PATCH 2/2] Add test for perl #134169
---
t/op/groups.t | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/t/op/groups.t b/t/op/groups.t
index e50c50a8c1..258e77333e 100644
--- a/t/op/groups.t
+++ b/t/op/groups.t
@@ -51,7 +51,7 @@ sub Test {
my %basegroup = basegroups( $pwgid, $pwgnam );
my @extracted_supplementary_groups = remove_basegroup( \ %basegroup, \ @extracted_groups );
- plan 2;
+ plan 3;
# Test: The supplementary groups in $( should match the
@@ -121,6 +121,17 @@ sub Test {
$gid_count->{0} //= 0;
ok 0 == $pwgid || $gid_count->{0} < 2, "groupstype should be type short, not long";
+ SKIP: {
+ # try to add nobody as supplementary group
+ my $root_uid = 0;
+ skip "uid!=0", 1 if $< != $root_uid and $> != $root_uid;
+ my $nobody = getgrnam("nobody")
+ or skip "Group `nobody' does not exist", 1;
+ $) = "$) $nobody";
+ my $ok = grep { $_ == $nobody } split ' ', $);
+ ok $ok, "Group `nobody' added as supplementary group";
+ }
+
return;
}
--
2.21.0
|
From @GrinnzFor posterity, the less weird way to set supplementary group IDs is directly with setgroups() or usually better initgroups(), which unfortunately are not currently provided by POSIX.pm, but an interface is provided by the CPAN modules Unix::Groups and Unix::Groups::FFI. |
From manuel@mausz.atOn Mon, 03 Jun 2019 16:26:59 -0700, manuel@mausz.at wrote:
Replying to myself as I seem to have missed CCing perl5-porters. You can find both the patch and a test in the RT. |
From devel@sumpfralle.deCreated by devel@sumpfralle.deThe behaviour of "$)" ($EFFECTIVE_GROUP_ID) has changed between 5.28 and 5.30: perl 5.28 # perl -E 'say perl 5.30 # perl -E 'say (example by "bes-internal"; see Specifying only a single number does not cause an error. Thank you for your time! Cheers, Perl Info |
From @tonycozOn Wed, 12 Jun 2019 17:54:36 -0700, devel@sumpfralle.de wrote:
The attached seems to fix it for me: # ./perl -e '$) = "0 0 1000"; system "id"' There's no tests for setting $) that I can find and I'm not sure it's practical to add one. Tony |
From @tonycoz0001-perl-134194-fix-parsing-supplemental-groups-from.patchFrom 4fe915fb80c78fa98164942ad75f29f44400898d Mon Sep 17 00:00:00 2001
From: Tony Cook <tony@develop-help.com>
Date: Thu, 13 Jun 2019 15:14:40 +1000
Subject: (perl #134194) fix parsing supplemental groups from $)
For example, if parsing the second number from:
"123 456 789"
endptr would be left pointing at the first space, while we try to start
parsing at the "4", which grok_atoUV() would reject.
---
mg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mg.c b/mg.c
index f4783fb68a..db831d8e86 100644
--- a/mg.c
+++ b/mg.c
@@ -3178,7 +3178,8 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
{
const char *p = SvPV_const(sv, len);
Groups_t *gary = NULL;
- const char* endptr = p + len;
+ const char * const end = p + len;
+ const char* endptr = end;
UV uv;
#ifdef _SC_NGROUPS_MAX
int maxgrp = sysconf(_SC_NGROUPS_MAX);
@@ -3209,6 +3210,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
Newx(gary, i + 1, Groups_t);
else
Renew(gary, i + 1, Groups_t);
+ endptr = end;
if (grok_atoUV(p, &uv, &endptr))
gary[i] = (Groups_t)uv;
else {
--
2.11.0
|
|
The RT System itself - Status changed from 'new' to 'open' |
From richard.purdie@linuxfoundation.orgCreated by richard.purdie@linuxfoundation.orgThis is a bug report for perl from richard.purdie@linuxfoundation.org, ----------------------------------------------------------------- #!/usr/bin/env perl Result from perl 5.28 under strace: setgroups(1, [2]) = 0 Result from perl 5.30 under strace: setgroups(1, [-1]) = -1 EINVAL (Invalid argument) and we isolated this to this change: https://perl5.git.perl.org/perl.git/commitdiff/5d4a52b5c68a11bfc97c2e24806993b84a61eade The issue is that the new function changes the endptr to the end of the A patch which fixes the issue for us is attached. [Just for reference/completeness, this is a cross compiled perl built using the Perl Info |
From richard.purdie@linuxfoundation.orgfix-setgroups.patchIndex: perl-5.30.0/mg.c
===================================================================
--- perl-5.30.0.orig/mg.c
+++ perl-5.30.0/mg.c
@@ -3179,6 +3256,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
const char *p = SvPV_const(sv, len);
Groups_t *gary = NULL;
const char* endptr = p + len;
+ const char* realend = p + len;
UV uv;
#ifdef _SC_NGROUPS_MAX
int maxgrp = sysconf(_SC_NGROUPS_MAX);
@@ -3209,6 +3287,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
Newx(gary, i + 1, Groups_t);
else
Renew(gary, i + 1, Groups_t);
+ endptr = realend;
if (grok_atoUV(p, &uv, &endptr))
gary[i] = (Groups_t)uv;
else {
|
From @jkeenanOn Fri, 14 Jun 2019 12:34:50 GMT, richard.purdie@linuxfoundation.org wrote:
For your program, I get the following results: ##### So I'm unsure how you got your results. Thank you very much. -- |
From @jkeenan |
|
The RT System itself - Status changed from 'new' to 'open' |
From @hvdsOn Fri, 14 Jun 2019 15:10:01 -0700, jkeenan wrote:
You need to be root, or otherwise privileged. As root, I can reproduce it here: 2 2 Of course that makes it difficult to spot bugs like this from the testsuite. :( Hugo |
From @tonycozOn Fri, 14 Jun 2019 19:08:00 -0700, hv wrote:
I wonder if it's worth splitting out the parsing into a non-API (but still exported) function that we can test in XS::APItest. Tony |
From @tonycozOn Mon, 03 Jun 2019 16:26:59 -0700, manuel@mausz.at wrote:
Which system did you test this on? My Debian system doesn't have a *group* called "nobody", though it does have a user. There is a group called "nogroup" (but that appears to be Debian specific.) Tony |
From manuel@mausz.atOn Sun, 16 Jun 2019 22:59:41 -0700, tonyc wrote:
Gentoo. But it looks like nobody is only optional: http://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/usernames.html#TBL-OPTUSERS I'll modify the test to iterate over all groups and use the first that the current process isn't part of. Btw these bugs are all duplicated of this: |
From manuel@mausz.atOn Mon, 17 Jun 2019 00:57:14 -0700, manuel@mausz.at wrote:
@tony: Attached is the modified test case. Please give it a try. |
From manuel@mausz.at0002-Add-test-for-perl-134169.patchFrom a034a095f078a50376034c7dcb56d03e1404c0ca Mon Sep 17 00:00:00 2001
From: Manuel Mausz <manuel@mausz.at>
Date: Mon, 17 Jun 2019 10:24:03 +0200
Subject: [PATCH 2/2] Add test for perl #134169
---
t/op/groups.t | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/t/op/groups.t b/t/op/groups.t
index e50c50a8c1..7e064cc21f 100644
--- a/t/op/groups.t
+++ b/t/op/groups.t
@@ -51,7 +51,7 @@ sub Test {
my %basegroup = basegroups( $pwgid, $pwgnam );
my @extracted_supplementary_groups = remove_basegroup( \ %basegroup, \ @extracted_groups );
- plan 2;
+ plan 3;
# Test: The supplementary groups in $( should match the
@@ -121,6 +121,26 @@ sub Test {
$gid_count->{0} //= 0;
ok 0 == $pwgid || $gid_count->{0} < 2, "groupstype should be type short, not long";
+ SKIP: {
+ # try to add a group as supplementary group
+ my $root_uid = 0;
+ skip "uid!=0", 1 if $< != $root_uid and $> != $root_uid;
+ my @groups = split ' ', $);
+ my @sup_group;
+ setgrent;
+ while(my @ent = getgrent) {
+ next if grep { $_ == $ent[2] } @groups;
+ @sup_group = @ent;
+ last;
+ }
+ endgrent;
+ skip "No group found we could add as a supplementary group", 1
+ if (!@sup_group);
+ $) = "$) @sup_group[2]";
+ my $ok = grep { $_ == $sup_group[2] } split ' ', $);
+ ok $ok, "Group `$sup_group[0]' added as supplementary group";
+ }
+
return;
}
--
2.21.0
|
From @tonycozOn Mon, 17 Jun 2019 01:32:28 -0700, manuel@mausz.at wrote:
Applied the fix as 79e302e, the test as 3121d45 and added you to AUTHORS in f83193f. Tony |
From @tonycozOn Sun, 16 Jun 2019 16:32:49 -0700, tonyc wrote:
Something like the attached. Tony |
From @tonycoz0001-perl-134169-make-the-code-that-splits-testable-witho.patchFrom 51b6f6aa2f1efb1559977dc46343582022772a93 Mon Sep 17 00:00:00 2001
From: Tony Cook <tony@develop-help.com>
Date: Thu, 11 Jul 2019 11:03:47 +1000
Subject: (perl #134169) make the code that splits $) testable without root
---
embed.fnc | 6 ++++
embed.h | 3 ++
ext/XS-APItest/APItest.pm | 2 +-
ext/XS-APItest/APItest.xs | 20 +++++++++++
ext/XS-APItest/t/magic.t | 8 +++++
mg.c | 88 ++++++++++++++++++++++++++---------------------
proto.h | 5 +++
7 files changed, 92 insertions(+), 40 deletions(-)
diff --git a/embed.fnc b/embed.fnc
index bfc9dca241..ac665ef3cb 100644
--- a/embed.fnc
+++ b/embed.fnc
@@ -1162,6 +1162,12 @@ ApdD |U32 |mg_length |NN SV* sv
ApdT |void |mg_magical |NN SV* sv
Apd |int |mg_set |NN SV* sv
Ap |I32 |mg_size |NN SV* sv
+
+: exported only for testing in XS::APItest
+#ifdef HAS_SETGROUPS
+ETp |int |split_groups |int maxgrp|NN Groups_t **groups|NN const char *start|NN const char *end
+#endif
+
ApT |void |mini_mktime |NN struct tm *ptm
Axmd |OP* |op_lvalue |NULLOK OP* o|I32 type
poX |OP* |op_lvalue_flags|NULLOK OP* o|I32 type|U32 flags
diff --git a/embed.h b/embed.h
index f72a7eec80..489c9aad78 100644
--- a/embed.h
+++ b/embed.h
@@ -1171,6 +1171,9 @@
#define dump_regex_sets_structures(a,b,c,d) S_dump_regex_sets_structures(aTHX_ a,b,c,d)
# endif
# endif
+# if defined(HAS_SETGROUPS)
+#define split_groups Perl_split_groups
+# endif
# if defined(PERL_ANY_COW)
#define sv_setsv_cow(a,b) Perl_sv_setsv_cow(aTHX_ a,b)
# endif
diff --git a/ext/XS-APItest/APItest.pm b/ext/XS-APItest/APItest.pm
index a4573b9028..ad619ea595 100644
--- a/ext/XS-APItest/APItest.pm
+++ b/ext/XS-APItest/APItest.pm
@@ -5,7 +5,7 @@ use strict;
use warnings;
use Carp;
-our $VERSION = '1.01';
+our $VERSION = '1.02';
require XSLoader;
diff --git a/ext/XS-APItest/APItest.xs b/ext/XS-APItest/APItest.xs
index 904462e4b4..033744a849 100644
--- a/ext/XS-APItest/APItest.xs
+++ b/ext/XS-APItest/APItest.xs
@@ -4475,6 +4475,26 @@ sv_magic(SV *sv, SV *thingy)
CODE:
sv_magic(SvRV(sv), NULL, PERL_MAGIC_ext, (const char *)thingy, 0);
+void
+split_groups(const char *p, int maxgrp = 10)
+ PREINIT:
+ Groups_t *gary = NULL;
+ int i, count;
+ PPCODE:
+ count = split_groups(maxgrp, &gary, p, p+strlen(p));
+ EXTEND(SP, count);
+ for (i = 0; i < count; ++i) {
+ PUSHs(sv_2mortal(newSVuv(gary[i])));
+ }
+ Safefree(gary);
+
+UV
+INVALID_GID()
+ CODE:
+ RETVAL = ((Gid_t)-1);
+ OUTPUT:
+ RETVAL
+
UV
test_get_vtbl()
PREINIT:
diff --git a/ext/XS-APItest/t/magic.t b/ext/XS-APItest/t/magic.t
index e47cd887cb..44ef0abed4 100644
--- a/ext/XS-APItest/t/magic.t
+++ b/ext/XS-APItest/t/magic.t
@@ -62,4 +62,12 @@ is $@, "", 'PERL_MAGIC_ext is permitted on read-only things';
is($i, 0, "hash () with set magic");
}
+# test the code used by $) magic
+is_deeply([ split_groups("1 2 3") ], [ 1, 2, 3 ],
+ "simple");
+is_deeply([ split_groups("10 11 12 13", 2) ], [ 10, 11, 12 ],
+ "hit maxgrps limit");
+is_deeply([ split_groups("x") ], [ INVALID_GID() ],
+ "bad input");
+
done_testing;
diff --git a/mg.c b/mg.c
index f235f0ee5a..e0e9c1572c 100644
--- a/mg.c
+++ b/mg.c
@@ -2755,6 +2755,51 @@ S_set_dollarzero(pTHX_ SV *sv)
#endif
}
+/* (hv) best guess: maybe we'll need configure probes to do a better job,
+ * but you can override it if you need to.
+ */
+#ifndef INVALID_GID
+#define INVALID_GID ((Gid_t)-1)
+#endif
+
+#ifdef HAS_SETGROUPS
+
+int
+Perl_split_groups(int maxgrp, Groups_t **groups, const char *p, const char *p_end) {
+ int i;
+ const char* endptr = p;
+ UV uv;
+ Groups_t *gary = NULL;
+
+ PERL_ARGS_ASSERT_SPLIT_GROUPS;
+
+ for (i = 0; i <= maxgrp; ++i) {
+ if (endptr == NULL)
+ break;
+ p = endptr;
+ endptr = p_end;
+ while (isSPACE(*p))
+ ++p;
+ if (!*p)
+ break;
+ if (!gary)
+ Newx(gary, i + 1, Groups_t);
+ else
+ Renew(gary, i + 1, Groups_t);
+ if (grok_atoUV(p, &uv, &endptr))
+ gary[i] = (Groups_t)uv;
+ else {
+ gary[i] = INVALID_GID;
+ endptr = NULL;
+ }
+ }
+ *groups = gary;
+
+ return i;
+}
+
+#endif
+
int
Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
{
@@ -3166,12 +3211,6 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
}
case ')':
{
-/* (hv) best guess: maybe we'll need configure probes to do a better job,
- * but you can override it if you need to.
- */
-#ifndef INVALID_GID
-#define INVALID_GID ((Gid_t)-1)
-#endif
/* XXX $) currently silently ignores failures */
Gid_t new_egid;
#ifdef HAS_SETGROUPS
@@ -3179,8 +3218,6 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
const char *p = SvPV_const(sv, len);
Groups_t *gary = NULL;
const char* p_end = p + len;
- const char* endptr = p_end;
- UV uv;
#ifdef _SC_NGROUPS_MAX
int maxgrp = sysconf(_SC_NGROUPS_MAX);
@@ -3189,37 +3226,10 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
#else
int maxgrp = NGROUPS;
#endif
-
- while (isSPACE(*p))
- ++p;
- if (grok_atoUV(p, &uv, &endptr))
- new_egid = (Gid_t)uv;
- else {
- new_egid = INVALID_GID;
- endptr = NULL;
- }
- for (i = 0; i < maxgrp; ++i) {
- if (endptr == NULL)
- break;
- p = endptr;
- endptr = p_end;
- while (isSPACE(*p))
- ++p;
- if (!*p)
- break;
- if (!gary)
- Newx(gary, i + 1, Groups_t);
- else
- Renew(gary, i + 1, Groups_t);
- if (grok_atoUV(p, &uv, &endptr))
- gary[i] = (Groups_t)uv;
- else {
- gary[i] = INVALID_GID;
- endptr = NULL;
- }
- }
- if (i)
- PERL_UNUSED_RESULT(setgroups(i, gary));
+ i = split_groups(maxgrp, &gary, p, p_end);
+ new_egid = i ? gary[0] : INVALID_GID;
+ if (i > 1)
+ PERL_UNUSED_RESULT(setgroups(i-1, gary+1));
Safefree(gary);
}
#else /* HAS_SETGROUPS */
diff --git a/proto.h b/proto.h
index a708e142cd..d23340fa25 100644
--- a/proto.h
+++ b/proto.h
@@ -4533,6 +4533,11 @@ PERL_CALLCONV int Perl_PerlProc_pipe_cloexec(pTHX_ int *pipefd)
assert(pipefd)
#endif
+#if defined(HAS_SETGROUPS)
+PERL_CALLCONV int Perl_split_groups(int maxgrp, Groups_t **groups, const char *start, const char *end);
+#define PERL_ARGS_ASSERT_SPLIT_GROUPS \
+ assert(groups); assert(start); assert(end)
+#endif
#if defined(HAS_SIGACTION) && defined(SA_SIGINFO)
PERL_CALLCONV Signal_t Perl_csighandler(int sig, siginfo_t *info, void *uap);
PERL_CALLCONV Signal_t Perl_sighandler(int sig, siginfo_t *info, void *uap);
--
2.11.0
|
From @df7cbFwiw, this bug is now killing PostgreSQL on Debian with perl 5.30.0-5 where we use $) to get into the ssl-cert group to read the system's SSL key: 5.28: $ sudo perl -e '$) = "118 118 42 108"; system "id"' 5.30: $ sudo perl -e '$) = "118 118 42 108"; system "id"' |
From @atoomicThis is a bug report for perl from atoomic@cpan.org, Setting $EGID, for example, is not working in the same way in 5.30.0 vs v5.28.0> ./perl -w -e 'my v5.30.0> ./perl -w -e 'my A git bisect points to the commit '5d4a52b5 grok_atoUV: allow non-C strings need some investigation Flags: Site configuration information for perl 5.30.0: Configured by cPanel at Thu Oct 3 17:32:39 CDT 2019. Summary of my perl5 (revision 5 version 30 subversion 0) configuration: Platform: Locally applied patches: @INC for perl 5.30.0: /usr/local/cpanel/3rdparty/perl/530/lib/perl5/cpanel_lib/x86_64-linux-64int Environment for perl 5.30.0: PATH=/root/.dotfiles/bin:/usr/local/cpanel/3rdparty/perl/530/bin:/usr/local/cpanel/3rdparty/perl/528/bin:/usr/local/cpanel/3rdparty/perl/526/bin:/usr/local/cpanel/3rdparty/perl/524/bin:/usr/local/cpanel/3rdparty/perl/522/bin:/usr/local/cpanel/3rdparty/perl/514/bin:/usr/local/cpanel/3rdparty/bin:/root/.cargo/bin:/usr/local/cpanel/3rdparty/lib/path-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin:/opt/cpanel/composer/bin:/root/.dotfiles/bin:/root/perl5/bin |
From nicolas@atoomic.orgThe only one-liner you need to reproduce the issue is
Removing the 's < *eptr' protection in Perl_grok_atoUV restore it to the previous behavior at first glance this is a regular assign... ╰─> perl -MO=Concise,-exec -e '$) = "202 202"' |
|
The RT System itself - Status changed from 'new' to 'open' |
From nicolas@atoomic.orgeuid set is magic, which is handled by Perl_magic_set from mg.c |
From nicolas@atoomic.orgI got a potential patch |
From nicolas@atoomic.org0001-Fixing-EUID-reduce-privilege.patchFrom 90ce72106c5e9c6aa26b90342def922f57a6abb9 Mon Sep 17 00:00:00 2001
From: Nicolas R <atoomic@cpan.org>
Date: Tue, 8 Oct 2019 12:58:06 -0500
Subject: [PATCH] Fixing EUID reduce privilege
---
mg.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mg.c b/mg.c
index b022d63442..1f77727409 100644
--- a/mg.c
+++ b/mg.c
@@ -3171,6 +3171,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
const char *p = SvPV_const(sv, len);
Groups_t *gary = NULL;
const char* endptr = p + len;
+ const char* back_endptr = endptr;
UV uv;
#ifdef _SC_NGROUPS_MAX
int maxgrp = sysconf(_SC_NGROUPS_MAX);
@@ -3183,6 +3184,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
while (isSPACE(*p))
++p;
+ endptr = back_endptr; /* we know where the end is */
if (grok_atoUV(p, &uv, &endptr))
new_egid = (Gid_t)uv;
else {
@@ -3201,6 +3203,7 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
Newx(gary, i + 1, Groups_t);
else
Renew(gary, i + 1, Groups_t);
+ endptr = back_endptr; /* we know where the end is */
if (grok_atoUV(p, &uv, &endptr))
gary[i] = (Groups_t)uv;
else {
--
2.23.0
|
From nicolas@atoomic.orgHere is the candidate fix, would appreciate any review Note: the test might need some extra love |
From nicolas@atoomic.orgthis seems to be a duplicate of https://rt-archive.perl.org/perl5/Ticket/Display.html?id=134169 |
From nicolas@atoomic.orgnote, a less intrusive patch could have been On Tue, 08 Oct 2019 04:54:01 -0700, cb@df7cb.de wrote:
|
Migrated from rt.perl.org#134169 (status was 'open')
Searchable as RT134169$
The text was updated successfully, but these errors were encountered: