From 0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379 Mon Sep 17 00:00:00 2001
From: Bernhard Voelker <mail@bernhard-voelker.de>
Date: Fri, 1 Aug 2014 02:07:33 +0200
Subject: chroot: perform chdir("/") again unless new --skip-chdir is specified

Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall
for "/" arguments (and synonyms).  The problem is that it also skips
the following chdir("/") call in that case.  The latter breaks existing
scripts which expect "/" to be the working directory inside the chroot.
While the first part of the change - i.e., skipping chroot("/") - is
okay for consistency with systems where it might succeed for a non-root
user, the second part might be malicious, e.g.

  cd /home/user && chroot '/' bin/foo

In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT,
but in the worst case, chroot(1) would execute '/home/user/bin/foo' in
the case that exists - instead of '/bin/foo'.

Revert that second part of the patch, i.e., perform the chdir("/)
in the common case again - unless the new --skip-chdir option is
specified.  Restrict this new option to the case of "/" arguments.

* src/chroot.c (SKIP_CHDIR): Add enum.
(long_opts): Add entry for the new --skip-chdir option.
(usage): Add --skip-chdir option, and while at it, move the other
to options into alphabetical order.
(main): Accept the above new option, allowing it only in the case
when NEWROOT is the old "/".
Move down the chdir() call after the if-clause to ensure it is
run in any case - unless --skip-chdir is specified.
Add a 'newroot' variable for the new root directory as it is used
in a couple of places now.
* tests/misc/chroot-fail.sh: Invert the last tests which check the
working directory of the execvp()ed program when a "/"-like
argument was passed: now expect it to be "/" - unless --skip-chdir
is given.
* doc/coreutils.texi (chroot invocation): Document the new option.
Document that chroot(1) usually calls chdir("/") unless the new
--skip-chdir option is specified.  Sort options.
* NEWS (Changes in behavior): Mention the fix.
(New features): Mention the new option.
* init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option.
* tests/cp/preserve-gid.sh (t1): Likewise.
* tests/cp/special-bits.sh: Likewise.
* tests/id/setgid.sh: Likewise.
* tests/misc/truncate-owned-by-other.sh: Likewise.
* tests/mv/sticky-to-xpart.sh: Likewise.
* tests/rm/fail-2eperm.sh: Likewise.
* tests/rm/no-give-up.sh: Likewise.
* tests/touch/now-owned-by-other.sh: Likewise.

Reported by Andreas Schwab in http://bugs.gnu.org/18062
---
 tests/mv/sticky-to-xpart.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'tests/mv')

diff --git a/tests/mv/sticky-to-xpart.sh b/tests/mv/sticky-to-xpart.sh
index e0c99e946..6c1f6e813 100755
--- a/tests/mv/sticky-to-xpart.sh
+++ b/tests/mv/sticky-to-xpart.sh
@@ -42,7 +42,8 @@ chmod go+x . || framework_failure_
 
 # Ensure that $NON_ROOT_USERNAME can access the required version of mv.
 version=$(
-  chroot --user=$NON_ROOT_USERNAME / env PATH="$PATH" mv --version |
+  chroot --skip-chdir --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
+    mv --version |
   sed -n '1s/.* //p'
 )
 case $version in
@@ -50,7 +51,7 @@ case $version in
   *) skip_ "cannot access just-built mv as user $NON_ROOT_USERNAME";;
 esac
 
-chroot --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
+chroot --skip-chdir --user=$NON_ROOT_USERNAME / env PATH="$PATH" \
   mv t/root-owned "$other_partition_tmpdir" 2> out-t && fail=1
 
 # On some systems, we get 'Not owner'.  Convert it.
-- 
cgit v1.2.3-70-g09d2