diff options
| author | Kaz Kylheku <kaz@kylheku.com> | 2022-07-23 20:01:15 -0700 |
|---|---|---|
| committer | Kaz Kylheku <kaz@kylheku.com> | 2022-07-23 20:01:15 -0700 |
| commit | 06540c9cef675fd8665325301384f3cc491e9f66 (patch) | |
| tree | 0e464a044c5b1416fbba74dde1bea880fcd56c43 /testsp.c | |
| parent | 3f164486df948220fc39f2471c9211086e0ac850 (diff) | |
| download | safepath-06540c9cef675fd8665325301384f3cc491e9f66.tar.gz safepath-06540c9cef675fd8665325301384f3cc491e9f66.tar.bz2 safepath-06540c9cef675fd8665325301384f3cc491e9f66.zip | |
Check using effective UID, not real.
We don't want to behave like the access function, which is
intended for use in setuid programs to determine what the
original user can access.
The purpose of safepath_check is to check whether the
filesystem can harm the caller. For that, the effective
identity that is being wielded should be used.
A setuid executable might have a real user ID bob,
but effective root. Root does not trust bob; root
doesn't want to follow a symlink controlled by bob.
* safepath.c (safe_group, tamper_proof): Replace getuid
calls with geteuid.
* README.md: Updated text.
Diffstat (limited to 'testsp.c')
0 files changed, 0 insertions, 0 deletions