New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing call to setgroups before setuid in sway/main.c #884

Closed

Fale opened this issue Sep 6, 2016 · 1 comment

Contributor

Fale commented Sep 6, 2016

In https://github.com/SirCmpwn/sway/blob/master/sway/main.c#L159 there is a call to setgroups before setuids.
There is a high probability this means it didn't relinquish all groups, and this would be a potential security issue to be fixed.
See https://www.securecoding.cert.org/confluence/display/c/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges

thejan2009 pushed a commit to thejan2009/sway that referenced this issue


          Split setgid and setuid, add privilege check

aa38bbd

This commit deals with issue swaywm#884. I consulted the following sources:
https://www.securecoding.cert.org/confluence/display/c/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges
and
https://www.securecoding.cert.org/confluence/display/c/POS37-C.+Ensure+that+privilege+relinquishment+is+successful

thejan2009 mentioned this issue

Split setgid and setuid, add privilege check [RFC] #911

Merged

thejan2009 pushed a commit to thejan2009/sway that referenced this issue


          Split setgid and setuid, add privilege check

5e585f9

This commit deals with issue swaywm#884. I consulted the following sources:
https://www.securecoding.cert.org/confluence/display/c/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges
and
https://www.securecoding.cert.org/confluence/display/c/POS37-C.+Ensure+that+privilege+relinquishment+is+successful

Contributor Author

Fale commented Sep 28, 2016

Closed via #911

Fale closed this as completed

ericonr mentioned this issue

missing-call-to-setgroups-before-setuid WayfireWM/wayfire#696

Closed

photosheep mentioned this issue

missing-call-to-setgroups-before-setuid rpmlint error project-repo/cagebreak#81

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment