summaryrefslogtreecommitdiff
path: root/tests/misc
diff options
context:
space:
mode:
authorBernhard Voelker <mail@bernhard-voelker.de>2014-08-01 02:07:33 +0200
committerBernhard Voelker <mail@bernhard-voelker.de>2014-08-01 12:35:05 +0200
commit0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379 (patch)
tree8fbc26f179a41417cb41a232db261d8f1ac0acd6 /tests/misc
parent0cf66cbe85009213bcf2608eceeee1355f367667 (diff)
downloadcoreutils-0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379.tar.xz
chroot: perform chdir("/") again unless new --skip-chdir is specified
Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall for "/" arguments (and synonyms). The problem is that it also skips the following chdir("/") call in that case. The latter breaks existing scripts which expect "/" to be the working directory inside the chroot. While the first part of the change - i.e., skipping chroot("/") - is okay for consistency with systems where it might succeed for a non-root user, the second part might be malicious, e.g. cd /home/user && chroot '/' bin/foo In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT, but in the worst case, chroot(1) would execute '/home/user/bin/foo' in the case that exists - instead of '/bin/foo'. Revert that second part of the patch, i.e., perform the chdir("/) in the common case again - unless the new --skip-chdir option is specified. Restrict this new option to the case of "/" arguments. * src/chroot.c (SKIP_CHDIR): Add enum. (long_opts): Add entry for the new --skip-chdir option. (usage): Add --skip-chdir option, and while at it, move the other to options into alphabetical order. (main): Accept the above new option, allowing it only in the case when NEWROOT is the old "/". Move down the chdir() call after the if-clause to ensure it is run in any case - unless --skip-chdir is specified. Add a 'newroot' variable for the new root directory as it is used in a couple of places now. * tests/misc/chroot-fail.sh: Invert the last tests which check the working directory of the execvp()ed program when a "/"-like argument was passed: now expect it to be "/" - unless --skip-chdir is given. * doc/coreutils.texi (chroot invocation): Document the new option. Document that chroot(1) usually calls chdir("/") unless the new --skip-chdir option is specified. Sort options. * NEWS (Changes in behavior): Mention the fix. (New features): Mention the new option. * init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option. * tests/cp/preserve-gid.sh (t1): Likewise. * tests/cp/special-bits.sh: Likewise. * tests/id/setgid.sh: Likewise. * tests/misc/truncate-owned-by-other.sh: Likewise. * tests/mv/sticky-to-xpart.sh: Likewise. * tests/rm/fail-2eperm.sh: Likewise. * tests/rm/no-give-up.sh: Likewise. * tests/touch/now-owned-by-other.sh: Likewise. Reported by Andreas Schwab in http://bugs.gnu.org/18062
Diffstat (limited to 'tests/misc')
-rwxr-xr-xtests/misc/chroot-fail.sh23
-rwxr-xr-xtests/misc/truncate-owned-by-other.sh2
2 files changed, 20 insertions, 5 deletions
diff --git a/tests/misc/chroot-fail.sh b/tests/misc/chroot-fail.sh
index a84826fd7..82ae23cdb 100755
--- a/tests/misc/chroot-fail.sh
+++ b/tests/misc/chroot-fail.sh
@@ -30,7 +30,7 @@ chroot --- / true # unknown option
test $? = 125 || fail=1
# Note chroot("/") succeeds for non-root users on some systems, but not all,
-# however we avoid the chroot() with "/" to have common behvavior.
+# however we avoid the chroot() with "/" to have common behavior.
chroot / sh -c 'exit 2' # exit status propagation
test $? = 2 || fail=1
chroot / . # invalid command
@@ -38,10 +38,25 @@ test $? = 126 || fail=1
chroot / no_such # no such command
test $? = 127 || fail=1
-# Ensure we don't chdir("/") when not changing root
-# to allow only changing user ids for a command.
-for dir in '/' '/.' '/../'; do
+# Ensure that --skip-chdir fails with a non-"/" argument.
+cat <<\EOF > exp || framework_failure_
+chroot: option --skip-chdir only permitted if NEWROOT is old '/'
+Try 'chroot --help' for more information.
+EOF
+chroot --skip-chdir . env pwd >out 2>err && fail=1
+compare /dev/null out || fail=1
+compare exp err || fail=1
+
+# Ensure we don't chroot("/") when NEWROOT is old "/".
+ln -s / isroot || framework_failure_
+for dir in '/' '/.' '/../' isroot; do
+ # Verify that chroot(1) succeeds and performs chdir("/")
+ # (chroot(1) of coreutils-8.23 failed to run the latter).
curdir=$(chroot "$dir" env pwd) || fail=1
+ test "$curdir" = '/' || fail=1
+
+ # Test the "--skip-chdir" option.
+ curdir=$(chroot --skip-chdir "$dir" env pwd) || fail=1
test "$curdir" = '/' && fail=1
done
diff --git a/tests/misc/truncate-owned-by-other.sh b/tests/misc/truncate-owned-by-other.sh
index e70badb6b..f65439ea1 100755
--- a/tests/misc/truncate-owned-by-other.sh
+++ b/tests/misc/truncate-owned-by-other.sh
@@ -29,7 +29,7 @@ chmod g+w root-owned
# Ensure that the current directory is searchable by $NON_ROOT_USERNAME.
chmod g+x .
-chroot --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
+chroot --skip-chdir --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
truncate -s0 root-owned || fail=1
Exit $fail