emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

subsystem: Prevent endless loop

Browse Source 
If a user has home directory "/" and login shell "*" then login and su
enter an endless loop by constantly switching to the next subsystem.

This could also be achieved with a layered approach so just checking
for "/" as home directory is not enough to protect against such a
misconfiguration.

Just break the loop if it progressed too far. I doubt that this has
negative impact on any real setup.

Signed-off-by: Samanta Navarro <ferivoz@riseup.net>
This commit is contained in:
Samanta Navarro 2023-05-23 11:53:53 +00:00 committed by Serge Hallyn
parent 419cf1f1c4
commit 4ad359ccc6
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libmisc/sub.c
View File

@ -15,8 +15,10 @@
#include <sys/types.h> #include <sys/types.h>
#include "prototypes.h" #include "prototypes.h"
#include "defines.h" #include "defines.h"
#define MAX_SUBROOT2 "maximum subsystem depth reached\n"
#define BAD_SUBROOT2 "invalid root `%s' for user `%s'\n" #define BAD_SUBROOT2 "invalid root `%s' for user `%s'\n"
#define NO_SUBROOT2 "no subsystem root `%s' for user `%s'\n" #define NO_SUBROOT2 "no subsystem root `%s' for user `%s'\n"
#define MAX_DEPTH 1024
/* /*
* subsystem - change to subsystem root * subsystem - change to subsystem root
* *
@ -27,6 +29,18 @@
*/ */
void subsystem (const struct passwd *pw) void subsystem (const struct passwd *pw)
{ {
static int depth = 0;
/*
* Prevent endless loop on misconfigured systems.
*/
if (++depth > MAX_DEPTH) {
printf (_("Maximum subsystem depth reached\n"));
SYSLOG ((LOG_WARN, MAX_SUBROOT2));
closelog ();
exit (EXIT_FAILURE);
}
/* /*
* The new root directory must begin with a "/" character. * The new root directory must begin with a "/" character.
*/ */