hardcoresushi
/
libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

macos: filter SUID and SGID bits in OpenatUser, MknodatUser, MkdiratUser 

When gocryptfs runs as root, we don't want to allow people to create
SUID root files.
This commit is contained in:
Jakob Unterwurzacher 2019-01-13 14:05:03 +01:00
parent 99e8b6d288
commit 711ef81bfb
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
internal/syscallcompat/sys_darwin.go
View File

@ -48,6 +48,9 @@ func Openat(dirfd int, path string, flags int, mode uint32) (fd int, err error)
func OpenatUser(dirfd int, path string, flags int, mode uint32, context *fuse.Context) (fd int, err error) {
// FIXME: take into account context.Owner
// Until we have that, filter SUID and SGID bits:
mode = filterSuidSgid(mode)
return Openat(dirfd, path, flags, mode)
}
@ -65,6 +68,9 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
func MknodatUser(dirfd int, path string, mode uint32, dev int, context *fuse.Context) (err error) {
// FIXME: take into account context.Owner
// Until we have that, filter SUID and SGID bits:
mode = filterSuidSgid(mode)
return Mknodat(dirfd, path, mode, dev)
}
@ -91,6 +97,9 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
func MkdiratUser(dirfd int, path string, mode uint32, context *fuse.Context) (err error) {
// FIXME: take into account context.Owner
// Until we have that, filter SUID and SGID bits:
mode = filterSuidSgid(mode)
return Mkdirat(dirfd, path, mode)
}
@ -101,3 +110,8 @@ func Fstatat(dirfd int, path string, stat *unix.Stat_t, flags int) (err error) {
func Getdents(fd int) ([]fuse.DirEntry, error) {
return emulateGetdents(fd)
}
// filterSuidSgid removes SUID and SGID bits from "mode".
func filterSuidSgid(mode uint32) uint32 {
return mode & ^uint32(syscall.S_ISGID|syscall.S_ISUID)
}