diff options
| author | Steven Barth <steven@midlink.org> | 2008-09-01 16:05:34 +0000 |
|---|---|---|
| committer | Steven Barth <steven@midlink.org> | 2008-09-01 16:05:34 +0000 |
| commit | bb8137062f3ea698d39ca25b86b44b9c3cc12dde (patch) | |
| tree | 876636c639f42b0be31f7552d1a294974595786a /libs | |
| parent | c1edac6ed0d69f4882aa56609b7c1be683da3333 (diff) | |
libs/web: Added several sanity checks to avoid local privilege escalation
Diffstat (limited to 'libs')
| -rw-r--r-- | libs/web/luasrc/dispatcher.lua | 8 | ||||
| -rw-r--r-- | libs/web/luasrc/sauth.lua | 10 |
2 files changed, 14 insertions, 4 deletions
diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua index 3805f5c9d..e3dc6370e 100644 --- a/libs/web/luasrc/dispatcher.lua +++ b/libs/web/luasrc/dispatcher.lua @@ -263,6 +263,13 @@ function createindex_plain(path, suffix) if indexcache then local cachedate = fs.mtime(indexcache) if cachedate and cachedate > fs.mtime(path) then + + assert( + sys.process.info("uid") == fs.stat(indexcache, "uid") + and fs.stat(indexcache, "mode") == "rw-------", + "Fatal: Indexcache is not sane!" + ) + index = loadfile(indexcache)() return index end @@ -287,6 +294,7 @@ function createindex_plain(path, suffix) if indexcache then fs.writefile(indexcache, util.get_bytecode(index)) + fs.chmod(indexcache, "a-rwx,u+rw") end end diff --git a/libs/web/luasrc/sauth.lua b/libs/web/luasrc/sauth.lua index 7c483119c..0ac236753 100644 --- a/libs/web/luasrc/sauth.lua +++ b/libs/web/luasrc/sauth.lua @@ -57,7 +57,7 @@ end -- @param id Session identifier -- @return Session data function read(id) - if not id or not sane() then + if not id or not sane(sessionpath .. "/" .. id) then return end clean() @@ -67,9 +67,11 @@ end --- Check whether Session environment is sane. -- @return Boolean status -function sane() - return luci.sys.process.info("uid") == luci.fs.stat(sessionpath, "uid") - and luci.fs.stat(sessionpath, "mode") == "rwx------" +function sane(file) + return luci.sys.process.info("uid") + == luci.fs.stat(file or sessionpath, "uid") + and luci.fs.stat(file or sessionpath, "mode") + == (file and "rw-------" or "rwx------") end |