Changeset 55 for trunk

Timestamp:

Aug 17, 2006, 10:31:24 PM (18 years ago)

Author:

rainer

Message:

Fix for bug with SuidCheckExclude (ticket #30)

Location:

trunk

Files:

• docs/Changelog (modified) (1 diff)
• src/sh_suidchk.c (modified) (2 diffs)
• test/testrun_1c.sh (modified) (2 diffs)

trunk/docs/Changelog

@@ +1 @@
+
+        * fix bug with SuidExclude (files in directory were still checked)
+
 2.2.3:
         * fix samhainadmin.pl: check for gpg-agent running if use-agent is set

trunk/src/sh_suidchk.c

@@ -519 +519 @@
           if (/*@-usedef@*/S_ISDIR(buf.st_mode)/*@+usedef@*/ &&
               (ShSuidchkExclude == NULL || 
-              0 != strncmp(tmpcat, ShSuidchkExclude, (size_t) ExcludeLen)))
+               0 != strcmp(tmpcat, ShSuidchkExclude)))
             {
               /* fs is a STATIC string
@@ -1118 +1118 @@
     SH_FREE(ShSuidchkExclude);
 
-  /* 1.8.1 add trailing slash
-   */
   ExcludeLen       = (int) sl_strlen(c);
-  if (c[ExcludeLen-1] != '/')
-    {
-      ExcludeLen++;
-      if ((ExcludeLen <= 0) || (ExcludeLen+1 <= 0)) /* may overflow */
-        {
-          SL_RETURN(-1, _("sh_suidchk_set_exclude"));
-        }
+  if (c[ExcludeLen-1] == '/')
+    {
+      c[ExcludeLen-1] = '\0';
+      ExcludeLen--;
     }
   ShSuidchkExclude = SH_ALLOC((size_t) ExcludeLen + 1);
   (void) sl_strlcpy(ShSuidchkExclude, c, (size_t)(ExcludeLen + 1));
-  ShSuidchkExclude[ExcludeLen-1] = '/';
 
   SL_RETURN(0, _("sh_suidchk_set_exclude"));

trunk/test/testrun_1c.sh

@@ -23 +23 @@
 export BUILDOPTS
 
-MAXTEST=6; export MAXTEST
+MAXTEST=7; export MAXTEST
 
 ## Quarantine SUID/SGID files if found
@@ -39 +39 @@
 # 
 # SuidCheckQuarantineDelete = yes
+
+SUIDPOLICY_7="
+[ReadOnly]
+file=${BASE}
+[SuidCheck]
+SuidCheckActive = yes
+SuidCheckExclude = ${BASE}/a/a
+SuidCheckInterval = 10
+SeveritySuidCheck = crit
+SuidCheckQuarantineFiles = no
+SuidCheckQuarantineMethod = 2
+SuidCheckQuarantineDelete = yes
+"
+
+mod_suiddata_7 () {
+    one_sec_sleep
+    chmod 4444 "${BASE}/a/a/y"
+    chmod 4444 "${BASE}/a/a/a/y"
+    mkdir "${BASE}/a/abc"
+    touch "${BASE}/a/abc/y"
+    chmod 4444 "${BASE}/a/abc/y"
+}
+
+chk_suiddata_7 () {
+    one_sec_sleep
+    tmp=`ls -l "${BASE}/a/a/y" 2>/dev/null | awk '{ print $1}'`
+    if [ "x$tmp" = "x-r-Sr--r--" ]; then
+        egrep "CRIT.*POLICY \[SuidCheck\].*${BASE}/a/a/y" $LOGFILE >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/y";
+            return 1
+        fi
+        egrep "CRIT.*POLICY ADDED.*${BASE}/a/a/y" $LOGFILE >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/y";
+            return 1
+        fi
+    else
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/y (suid not kept)";
+        return 1
+    fi
+    tmp=`ls -l "${BASE}/a/a/a/y" 2>/dev/null | awk '{ print $1}'`
+    if [ "x$tmp" = "x-r-Sr--r--" ]; then
+        egrep "CRIT.*POLICY \[SuidCheck\].*${BASE}/a/a/a/y" $LOGFILE >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/a/y";
+            return 1
+        fi
+        egrep "CRIT.*POLICY ADDED.*${BASE}/a/a/a/y" $LOGFILE >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/a/y";
+            return 1
+        fi
+    else
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/a/a/y (suid not kept)";
+        return 1
+    fi
+    tmp=`ls -l "${BASE}/a/abc/y" 2>/dev/null | awk '{ print $1}'`
+    if [ "x$tmp" = "x-r-Sr--r--" ]; then
+        egrep "CRIT.*POLICY \[SuidCheck\].*${BASE}/a/abc/y" $LOGFILE >/dev/null 2>&1
+        if [ $? -ne 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "${BASE}/a/abc/y";
+            return 1
+        fi
+        egrep "CRIT.*POLICY ADDED.*${BASE}/a/abc/y" $LOGFILE >/dev/null 2>&1
+        if [ $? -ne 0 ]; then
+            [ -z "$verbose" ] || log_msg_fail "${BASE}/a/abc/y";
+            return 1
+        fi
+        return 0;
+    else
+        [ -z "$verbose" ] || log_msg_fail "${BASE}/a/abc/y (suid not kept)";
+        return 1
+    fi
+}
+
 
 SUIDPOLICY_6="