sergio/takana
> Una distribución Linux construida con un laboratorio funcional y hermético en el > sótano, y una terminal mutable, clásica y anárquica en el piso de arriba — diseñada > desde el suelo para que una IA programadora entienda, modifique y co…
base-system: promover 17 esenciales a canónicas + repo firmado (713→730)
1This patch has been taken from OpenBSD upstream, it changes permit bits to make
2them more rowhammer-resistent. A similar patch has also been committed to sudo.
3
4The patch has not made its way into OpenDoas yet, but at the time of writting
5OpenDoas upstream is rather stale (last commit was done 2 years ago).
6
7See:
8
9* https://github.com/openbsd/src/commit/38599afa1d1d1f14a897b01350e8ce94486e1788
10* https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f
11
12diff --git a/doas.c b/doas.c
13index ac3a42a..93f0836 100644
14--- a/doas.c
15+++ b/doas.c
16@@ -148,8 +148,10 @@ permit(uid_t uid, gid_t *groups, int ngroups, const struct rule **lastr,
17 *lastr = rules[i];
18 }
19 if (!*lastr)
20+ return -1;
21+ if ((*lastr)->action == PERMIT)
22 return 0;
23- return (*lastr)->action == PERMIT;
24+ return -1;
25 }
26
27 static void
28@@ -184,6 +186,7 @@ checkconfig(const char *confpath, int argc, char **argv,
29 uid_t uid, gid_t *groups, int ngroups, uid_t target)
30 {
31 const struct rule *rule;
32+ int rv;
33
34 if (setresuid(uid, uid, uid) != 0)
35 err(1, "setresuid");
36@@ -191,9 +194,9 @@ checkconfig(const char *confpath, int argc, char **argv,
37 parseconfig(confpath, 0);
38 if (!argc)
39 exit(0);
40-
41- if (permit(uid, groups, ngroups, &rule, target, argv[0],
42- (const char **)argv + 1)) {
43+ rv = permit(uid, groups, ngroups, &rule, target, argv[0],
44+ (const char **)argv + 1);
45+ if (rv == 0) {
46 printf("permit%s\n", (rule->options & NOPASS) ? " nopass" : "");
47 exit(0);
48 } else {
49@@ -342,8 +345,9 @@ main(int argc, char **argv)
50 }
51
52 cmd = argv[0];
53- if (!permit(uid, groups, ngroups, &rule, target, cmd,
54- (const char **)argv + 1)) {
55+ rv = permit(uid, groups, ngroups, &rule, target, cmd,
56+ (const char **)argv + 1);
57+ if (rv != 0) {
58 syslog(LOG_AUTHPRIV | LOG_NOTICE,
59 "command not permitted for %s: %s", mypw->pw_name, cmdline);
60 errc(1, EPERM, NULL);
61diff --git a/doas.h b/doas.h
62index a8aa41b..591816f 100644
63--- a/doas.h
64+++ b/doas.h
65@@ -36,7 +36,7 @@ struct passwd;
66 char **prepenv(const struct rule *, const struct passwd *,
67 const struct passwd *);
68
69-#define PERMIT 1
70+#define PERMIT -1
71 #define DENY 2
72
73 #define NOPASS 0x1