Attachment 153231 Details for Bug 237358 – Modify the permission checks

[patch] Modify the permission checks

audit-perms.patch (text/plain), 2.71 KB, created by Miloslav Trmač on 2007-04-21 01:34:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Miloslav Trmač

Created: 2007-04-21 01:34:23 UTC

Size: 2.71 KB

patch

obsolete

>diff -ur audit/audisp/new/audispd-config.c audit-1.5.2/audisp/new/audispd-config.c
>--- audit/audisp/new/audispd-config.c	2007-04-03 20:55:39.000000000 +0200
>+++ audit-1.5.2/audisp/new/audispd-config.c	2007-04-21 03:24:50.000000000 +0200
>@@ -356,7 +356,7 @@
> 		audit_msg(LOG_ERR, "%s is not owned by root", nv->value);
> 		return 1;
> 	}
>-	if ((buf.st_mode & (S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP)) !=
>+	if ((buf.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) !=
> 			   (S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP)) {
> 		audit_msg(LOG_ERR, "%s permissions should be 0750", nv->value);
> 		return 1;
>diff -ur audit/auparse/auditd-config.c audit-1.5.2/auparse/auditd-config.c
>--- audit/auparse/auditd-config.c	2007-02-19 21:26:32.000000000 +0100
>+++ audit-1.5.2/auparse/auditd-config.c	2007-04-21 03:22:48.000000000 +0200
>@@ -334,7 +334,7 @@
> 		audit_msg(LOG_ERR, "%s is not owned by root", val);
> 		return 1;
> 	}
>-	if ((buf.st_mode & (S_IRUSR|S_IWUSR|S_IRGRP)) != 
>+	if ((buf.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) !=
> 			   (S_IRUSR|S_IWUSR|S_IRGRP)) {
> 		audit_msg(LOG_ERR, "%s permissions should be 0640", val);
> 		return 1;
>diff -ur audit/src/auditd-config.c audit-1.5.2/src/auditd-config.c
>--- audit/src/auditd-config.c	2007-03-11 18:03:02.000000000 +0100
>+++ audit-1.5.2/src/auditd-config.c	2007-04-21 03:19:21.000000000 +0200
>@@ -483,7 +483,7 @@
> 		audit_msg(LOG_ERR, "%s is not owned by root", nv->value);
> 		return 1;
> 	}
>-	if ((buf.st_mode & (S_IRUSR|S_IWUSR|S_IRGRP)) != 
>+	if ((buf.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) !=
> 			   (S_IRUSR|S_IWUSR|S_IRGRP)) {
> 		audit_msg(LOG_ERR, "%s permissions should be 0640", nv->value);
> 		return 1;
>@@ -601,9 +601,13 @@
> 		audit_msg(LOG_ERR, "%s is not owned by root", nv->value);
> 		return 1;
> 	}
>-	if ((buf.st_mode & (S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP)) !=
>-			   (S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP)) {
>-		audit_msg(LOG_ERR, "%s permissions should be 0750", nv->value);
>+	if ((buf.st_mode & S_IRWXU) != S_IRWXU) {
>+		audit_msg(LOG_ERR, "%s permissions should be 07xx", nv->value);
>+		return 1;
>+	}
>+	if ((buf.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
>+		audit_msg(LOG_ERR, "%s should be writable only by owner",
>+			  nv->value);
> 		return 1;
> 	}
> 	free((void *)config->dispatcher);
>@@ -784,9 +788,12 @@
> 		audit_msg(LOG_ERR, "%s is not owned by root", val);
> 		return -1;
> 	}
>-	if ((buf.st_mode & (S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP)) !=
>-			   (S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP)) {
>-		audit_msg(LOG_ERR, "%s permissions should be 0750", val);
>+	if ((buf.st_mode & S_IRWXU) != S_IRWXU) {
>+		audit_msg(LOG_ERR, "%s permissions should be 07xx", val);
>+		return -1;
>+	}
>+	if ((buf.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
>+		audit_msg(LOG_ERR, "%s should be writable only by owner", val);
> 		return -1;
> 	}
> 	return 0;

Actions: View | Diff

Attachments on bug 237358: 153231