@@ -48,7 +48,7 @@ extern char* _mktemp(char*); /* mktemp doesn't link right. Don't ask me why. */
4848extern sqlite3 * database_init ();
4949extern int database_check (sqlite3 * , struct su_initiator * , struct su_request * );
5050
51- /* Not lazy anymore, just need these in too many places */
51+ /* Still lazt, will fix this */
5252static char * socket_path = NULL ;
5353static sqlite3 * db = NULL ;
5454
@@ -318,7 +318,8 @@ int main(int argc, char *argv[])
318318 }
319319 } else if (!strcmp (argv [i ], "-s" ) || !strcmp (argv [i ], "--shell" )) {
320320 if (++ i < argc ) {
321- strcpy (shell , argv [i ]);
321+ strncpy (shell , argv [i ], sizeof (shell ));
322+ shell [sizeof (shell ) - 1 ] = 0 ;
322323 } else {
323324 usage ();
324325 }
@@ -351,9 +352,11 @@ int main(int argc, char *argv[])
351352 }
352353 }
353354
354- from_init (& su_from );
355+ if (from_init (& su_from ) < 0 ) {
356+ deny ();
357+ }
355358
356- if (su_from .uid == AID_ROOT )
359+ if (su_from .uid == AID_ROOT || su_from . uid == AID_SHELL )
357360 allow (shell );
358361
359362 if (stat (REQUESTOR_DATA_PATH , & st ) < 0 ) {
@@ -370,14 +373,14 @@ int main(int argc, char *argv[])
370373
371374 req_uid = st .st_uid ;
372375
373- if (from_init (& su_from ) < 0 ) {
374- deny ();
375- }
376-
377376 if (mkdir (REQUESTOR_CACHE_PATH , 0771 ) >= 0 ) {
378377 chown (REQUESTOR_CACHE_PATH , req_uid , req_uid );
379378 }
380379
380+ setgroups (0 , NULL );
381+ setegid (st .st_gid );
382+ seteuid (st .st_uid );
383+
381384 LOGE ("sudb - Opening database" );
382385 db = database_init ();
383386 if (!db ) {
@@ -391,14 +394,15 @@ int main(int argc, char *argv[])
391394 // Close the database, we're done with it. If it stays open,
392395 // it will cause problems
393396 sqlite3_close (db );
397+ db = NULL ;
394398 LOGE ("sudb - Database closed" );
395399 }
396400
397401 switch (dballow ) {
398- case DB_DENY : LOGE ( "denying" ); deny ();
399- case DB_ALLOW : LOGE ( "allowing" ); allow (shell );
400- case DB_INTERACTIVE : LOGE ( "asking" ); break ;
401- default : LOGE ( "default, denying" ); deny ();
402+ case DB_DENY : deny ();
403+ case DB_ALLOW : allow (shell );
404+ case DB_INTERACTIVE : break ;
405+ default : deny ();
402406 }
403407
404408 socket_serv_fd = socket_create_temp (req_uid );
0 commit comments