🚀 go-pugleaf

Subject: fix for chown security problem
Index: sys/ufs_syscalls.c IBM4.3-AOS

Description:
	There's a security problem associated with 4.3BSD and 4.3BSD-tahoe
	systems involving the chown(2) system call.  It exists in IBM's
	4.3BSD derived system.

	This patch is consistent with the patch to sccsid version 7.3 made
	by Berkeley.

Fix:
	Apply the attached patch to rcsid version 12.0 of ufs_syscalls.c.

*** ufs_syscalls.c	Mon Jul 10 15:05:08 1989
--- ufs_syscalls.c.orig	Mon Jul 10 15:03:52 1989
***************
*** 865,880 ****
  	if ((ip = owner(uap->fname, NOFOLLOW, rmt_simple_path, RT_chown, 
  						uap->uid, uap->gid)) == NULL)
  #else
! #ifdef UCBFIX
! /* This is UCBFIX 1.77, there are no other UCBFIX ifdef's in this file. */
! 	register struct nameidata *ndp = &u.u_nd;
! 
! 	ndp->ni_nameiop = LOOKUP | NOFOLLOW;
! 	ndp->ni_segflg = UIO_USERSPACE;
! 	ndp->ni_dirp = uap->fname;
! 	ip = namei(ndp);
! 	if (ip == NULL)
! #endif UCBFIX
  #endif
  		return;
  	u.u_error = chown1(ip, uap->uid, uap->gid);
--- 865,871 ----
  	if ((ip = owner(uap->fname, NOFOLLOW, rmt_simple_path, RT_chown, 
  						uap->uid, uap->gid)) == NULL)
  #else
! 	if ((ip = owner(uap->fname, NOFOLLOW)) == NULL)
  #endif
  		return;
  	u.u_error = chown1(ip, uap->uid, uap->gid);
***************
*** 940,955 ****
  		uid = ip->i_uid;
  	if (gid == -1)
  		gid = ip->i_gid;
! #ifdef UCBFIX
! /* This is UCBFIX 1.77, there are no other UCBFIX ifdef's in this file. */
! 	/*
! 	 * If we don't own the file, are trying to change the owner
! 	 * of the file, or are not a member of the target group,
! 	 * the caller must be superuser or the call fails.
! 	 */
! 	if ((u.u_uid != ip->i_uid || uid != ip->i_uid ||
! 	    !groupmember((gid_t)gid)) && !suser())
! #endif UCBFIX
  		return (u.u_error);
  #ifdef QUOTA
  	if (ip->i_uid == uid)		/* this just speeds things a little */
--- 931,939 ----
  		uid = ip->i_uid;
  	if (gid == -1)
  		gid = ip->i_gid;
! 	if (uid != ip->i_uid && !suser())
! 		return (u.u_error);
! 	if (gid != ip->i_gid && !groupmember((gid_t)gid) && !suser())
  		return (u.u_error);
  #ifdef QUOTA
  	if (ip->i_uid == uid)		/* this just speeds things a little */

Eric Brunner
uunet!ibmsupt!brunner