Attachment 161324 Details for Bug 251774 – RHEL 5.1 patch. Includes both the patch file and patch to the spec file

[patch] RHEL 5.1 patch. Includes both the patch file and patch to the spec file

patch (text/plain), 6.08 KB, created by Bob Relyea on 2007-08-15 02:12:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bob Relyea

Created: 2007-08-15 02:12:25 UTC

Size: 6.08 KB

patch

obsolete

>? patch
>Index: coolkey-cache-dir-move.patch
>===================================================================
>RCS file: coolkey-cache-dir-move.patch
>diff -N coolkey-cache-dir-move.patch
>--- /dev/null	1 Jan 1970 00:00:00 -0000
>+++ coolkey-cache-dir-move.patch	15 Aug 2007 02:01:45 -0000
>@@ -0,0 +1,177 @@
>+Index: src/coolkey/machdep.cpp
>+===================================================================
>+RCS file: /cvs/dirsec/coolkey/src/coolkey/machdep.cpp,v
>+retrieving revision 1.4
>+diff -u -r1.4 machdep.cpp
>+--- src/coolkey/machdep.cpp	14 Feb 2007 00:46:28 -0000	1.4
>++++ src/coolkey/machdep.cpp	15 Aug 2007 01:41:11 -0000
>+@@ -185,12 +185,20 @@
>+ #define MAP_INHERIT 0
>+ #endif
>+ 
>++#ifndef BASEPATH
>++#ifdef MAC
>++#define BASEPATH "/var"
>++#else
>++#define BASEPATH "/var/cache"
>++#endif
>++#endif
>++
>+ #ifdef FULL_CLEANUP
>+ #define RESERVED_OFFSET 256
>+-#define MEMSEGPATH "/tmp/.pk11ipc"
>++#define MEMSEGPATH BASEPATH"/coolkey-lock"
>+ #else 
>+ #define RESERVED_OFFSET 0
>+-#define MEMSEGPATH "/tmp/.pk11ipc1"
>++#define MEMSEGPATH BASEPATH"/coolkey"
>+ #endif
>+ 
>+ struct SHMemData {
>+@@ -208,11 +216,6 @@
>+ #ifdef FULL_CLEANUP
>+ 	flock(fd,LOCK_EX);
>+ 	unsigned long ref = --(*(unsigned long *)addr); 
>+-#ifdef notdef
>+-	if (ref == 0) {
>+-	    unlink(path);
>+-	}
>+-#endif
>+ 	flock(fd, LOCK_UN);
>+ #endif
>+ 	munmap(addr,size+RESERVED_OFFSET);
>+@@ -225,6 +228,73 @@
>+     }
>+ }
>+ 
>++/*
>++ * The cache directory is shared and accessible by anyone, make
>++ * sure the cache file we are opening is really a valid cache file.
>++ */
>++int safe_open(char *path, int flags, int mode, int size)
>++{
>++    struct stat buf;
>++    int fd, ret;
>++
>++    fd = open (path, flags|O_NOFOLLOW, mode);
>++
>++    if (fd < 0) {
>++	return fd;
>++    }
>++
>++    ret = fstat(fd, &buf);
>++    if (ret < 0) {
>++	close (fd);
>++	return ret;
>++    }
>++
>++    /* our cache files are pretty specific, make sure we are looking
>++     * at the correct one */
>++
>++    /* first, we should own the file ourselves, don't open a file
>++     * that someone else wanted us to see. */
>++    if (buf.st_uid != getuid()) {
>++	close(fd);
>++	errno = EACCES;
>++	return -1;
>++    }
>++
>++    /* next, there should only be one link in this file. Don't
>++     * use this code to trash another file */
>++    if (buf.st_nlink != 1) {
>++	close(fd);
>++	errno = EMLINK;
>++	return -1;
>++    }
>++
>++    /* next, This better be a regular file */
>++    if (!S_ISREG(buf.st_mode)) {
>++	close(fd);
>++	errno = EACCES;
>++	return -1;
>++    }
>++
>++    /* if the permissions don't match, something is wrong */
>++    if ((buf.st_mode & 03777) != mode) {
>++	close(fd);
>++	errno = EACCES;
>++	return -1;
>++    }
>++
>++    /* finally the file should be the correct size. This 
>++     * check isn't so much to protect from an attack, as it is to
>++     * detect a corrupted cache file */
>++    if (buf.st_size != size) {
>++	close(fd);
>++	errno = EACCES;
>++	return -1;
>++    }
>++
>++    /* OK, the file checked out, ok to continue */
>++    return fd;
>++}
>++
>+ SHMem::SHMem(): shmemData(0) {}
>+ 
>+ SHMem *
>+@@ -248,7 +318,7 @@
>+ 	return NULL;
>+     }
>+     int mask = umask(0);
>+-    int ret = mkdir (MEMSEGPATH, 0777);
>++    int ret = mkdir (MEMSEGPATH, 1777);
>+     umask(mask);
>+     if ((ret == -1) && (errno != EEXIST)) {
>+ 	delete shmemData;
>+@@ -264,21 +334,16 @@
>+     shmemData->path[sizeof(MEMSEGPATH)-1] = '/';
>+     strcpy(&shmemData->path[sizeof(MEMSEGPATH)],name);
>+ 
>+-    int mode = 0777;
>+-    if (strcmp(name,"token_names") != 0) {
>+-	/* each user gets his own uid array */
>+-    	sprintf(uid_str, "-%u",getuid());
>+-    	strcat(shmemData->path,uid_str);
>+-	mode = 0700;
>+-    } 
>++    sprintf(uid_str, "-%u",getuid());
>++    strcat(shmemData->path,uid_str);
>++    int mode = 0600;
>++
>+     shmemData->fd = open(shmemData->path, 
>+ 		O_CREAT|O_RDWR|O_EXCL|O_APPEND|O_EXLOCK, mode);
>+-    if (shmemData->fd  < 0) {
>+-	needInit = false;
>+-	shmemData->fd = open(shmemData->path,O_RDWR|O_EXLOCK, mode);
>+-    }  else {
>++    if (shmemData->fd >= 0) {
>+ 	char *buf;
>+ 	int len = size+RESERVED_OFFSET;
>++	int ret;
>+ 
>+ 	buf = (char *)calloc(1,len);
>+ 	if (!buf) {
>+@@ -289,8 +354,22 @@
>+ 	    delete shmemData;
>+ 	    return NULL;
>+ 	}
>+-	write(shmemData->fd,buf,len);
>++	ret = write(shmemData->fd,buf,len);
>++	if (ret != len) {
>++	    unlink(shmemData->path);
>++#ifdef FULL_CLEANUP
>++	    flock(shmemData->fd, LOCK_UN);
>++#endif
>++	    delete shmemData;
>++	    return NULL;
>++	}
>++	
>+ 	free(buf);
>++    } else if (errno == EEXIST) {
>++	needInit = false;
>++
>++	shmemData->fd = safe_open(shmemData->path,O_RDWR|O_EXLOCK, mode,
>++				  size+RESERVED_OFFSET);
>+     }
>+     if (shmemData->fd < 0) {
>+ 	delete shmemData;
>Index: coolkey.spec
>===================================================================
>RCS file: /cvs/dist/rpms/coolkey/RHEL-5/coolkey.spec,v
>retrieving revision 1.23
>diff -u -r1.23 coolkey.spec
>--- coolkey.spec	9 Jul 2007 18:03:59 -0000	1.23
>+++ coolkey.spec	15 Aug 2007 02:01:45 -0000
>@@ -22,11 +22,12 @@
> 
> Name: coolkey
> Version: 1.1.0
>-Release: 3%{dist}
>+Release: 4%{dist}
> Summary: CoolKey PKCS #11 module
> License: LGPL
> URL: http://directory.fedora.redhat.com/wiki/CoolKey
> Source: coolkey-%{version}.tar.gz
>+Patch1: coolkey-cache-dir-move.patch
> Group: System Environment/Libraries
> BuildRoot:  %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
> BuildRequires: pcsc-lite-devel
>@@ -56,6 +57,7 @@
> 
> %prep
> %setup -q
>+%patch1 -b .cache.dir.move
> 
> %build
> autoconf
>@@ -66,6 +68,7 @@
> rm -rf $RPM_BUILD_ROOT
> make install DESTDIR=$RPM_BUILD_ROOT
> ln -s pkcs11/libcoolkeypk11.so $RPM_BUILD_ROOT/%{_libdir}
>+mkdir -p $RPM_BUILD_ROOT/var/cache/coolkey
> 
> %clean
> rm -rf $RPM_BUILD_ROOT
>@@ -95,6 +98,7 @@
> %{_libdir}/pkcs11/libcoolkeypk11.so
> %{_libdir}/libckyapplet.so.1
> %{_libdir}/libckyapplet.so.1.0.0
>+%attr(1777,root,root) /var/cache/coolkey
> 
> %files devel
> %{_libdir}/libckyapplet.so
>@@ -103,7 +107,10 @@
> 
> 
> %changelog
>-* Thu May 31 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-2
>+* Tue Aug 13 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-4
>+- fix cache location to be more secure
>+
>+* Thu May 31 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-3
> - replace the install stuff
> 
> * Thu May 31 2007 Bob Relyea <rrelyea@redhat.com> - 1.1.0-2

Actions: View | Diff

Attachments on bug 251774: 161102 | 161324