diff options
| author |   Martin Schlemmer <azarah@gentoo.org> | 2003-10-13 19:43:25 +0000 |
|---|---|---|
| committer | Martin Schlemmer <azarah@gentoo.org> | 2003-10-13 19:43:25 +0000 |
| commit | c3bf786063202d36df200b921f9034ffc50f52f1 (patch) | |
| tree | 134f94fe614b30d69b93d08a7a3b3941bd6edc47 /src | |
| parent | portage-2.0.49-r13/14 (diff) | |
| download | portage-cvs-c3bf786063202d36df200b921f9034ffc50f52f1.tar.gz portage-cvs-c3bf786063202d36df200b921f9034ffc50f52f1.tar.bz2 portage-cvs-c3bf786063202d36df200b921f9034ffc50f52f1.zip | |
Fix a bug in libsandbox.c 's checking in the rename wrapper - it basically
only checked the destination patch, and not the source, so we could move
a protected file to a unprotected directory, and then delete/modify it.
Thanks to Andrea Luzzardi (scox) <al@sig11.org>, bug #30992, for this fix.
Diffstat (limited to 'src')
| -rw-r--r-- | src/sandbox-1.1/ChangeLog | 12 | ||||
| -rw-r--r-- | src/sandbox-1.1/libsandbox.c | 8 |
2 files changed, 13 insertions, 7 deletions
diff --git a/src/sandbox-1.1/ChangeLog b/src/sandbox-1.1/ChangeLog index 0de57f2..d3ee048 100644 --- a/src/sandbox-1.1/ChangeLog +++ b/src/sandbox-1.1/ChangeLog @@ -1,9 +1,15 @@ # ChangeLog for Path Sandbox # Copyright 2002 Gentoo Technologies, Inc.; Distributed under the GPL v2 -# $Header: /local/data/ulm/cvs/history/var/cvsroot/gentoo-src/portage/src/sandbox-1.1/Attic/ChangeLog,v 1.23 2003/10/12 22:38:11 carpaski Exp $ +# $Header: /local/data/ulm/cvs/history/var/cvsroot/gentoo-src/portage/src/sandbox-1.1/Attic/ChangeLog,v 1.24 2003/10/13 19:43:25 azarah Exp $ - 12 Oct 2003; Nicholas Jones <carpaski@gentoo.org> sandbox.c: Added python2.3 - to the predict section/variable. + 13 Oct 2003; Martin Schlemmer <azarah@gentoo.org> libsandbox.c : + Fix a bug in libsandbox.c 's checking in the rename wrapper - it basically + only checked the destination patch, and not the source, so we could move + a protected file to a unprotected directory, and then delete/modify it. + Thanks to Andrea Luzzardi (scox) <al@sig11.org>, bug #30992, for this fix. + + 12 Oct 2003; Nicholas Jones <carpaski@gentoo.org> sandbox.c : + Added python2.3 to the predict section/variable. 28 Sep 2003; Martin Schlemmer <azarah@gentoo.org> libsandbox.c, sandbox.c, sandbox.h, sandbox_futils.c : diff --git a/src/sandbox-1.1/libsandbox.c b/src/sandbox-1.1/libsandbox.c index dc317db..c830591 100644 --- a/src/sandbox-1.1/libsandbox.c +++ b/src/sandbox-1.1/libsandbox.c @@ -25,7 +25,7 @@ * as some of the InstallWatch code was used. * * - * $Header: /local/data/ulm/cvs/history/var/cvsroot/gentoo-src/portage/src/sandbox-1.1/Attic/libsandbox.c,v 1.11 2003/09/28 08:37:19 azarah Exp $ + * $Header: /local/data/ulm/cvs/history/var/cvsroot/gentoo-src/portage/src/sandbox-1.1/Attic/libsandbox.c,v 1.12 2003/10/13 19:43:25 azarah Exp $ * */ @@ -564,11 +564,11 @@ rename(const char *oldpath, const char *newpath) canonicalize_int(oldpath, old_canonic); canonicalize_int(newpath, new_canonic); - if FUNCTION_SANDBOX_SAFE - ("rename", new_canonic) { + if (FUNCTION_SANDBOX_SAFE("rename", old_canonic) && + FUNCTION_SANDBOX_SAFE("rename", new_canonic)) { check_dlsym(rename); result = true_rename(oldpath, newpath); - } + } return result; } |