From rutgers!apple!usc!cs.utexas.edu!uunet!ibmpa!bullhead!brunner Wed Jul 26 14:57:12 EDT 1989
Article 978 of comp.sys.ibm.pc.rt:
Path: cmcl2!rutgers!apple!usc!cs.utexas.edu!uunet!ibmpa!bullhead!brunner
>From: brunner@bullhead.uucp
Newsgroups: comp.sys.ibm.pc.rt
Subject: Patch for /sys/sys/ufs_syscalls.c
Summary: Fixes chown security hole
Keywords: V1.9 chown security
Message-ID: <1514@ibmpa.UUCP>
Date: 24 Jul 89 22:02:28 GMT
References: <1511@ibmpa.UUCP>
Sender: news@ibmpa.UUCP
Reply-To: brunner@ibmsupt.UUCP ()
Organization: IBM AWD Palo Alto
Lines: 73

Subject: fix for chown security problem
Index: sys/ufs_syscalls.c IBM4.3-AOS

Description:
	There's a security problem associated with 4.3BSD and 4.3BSD-tahoe
	systems involving the chown(2) system call.  It exists in IBM's
	4.3BSD derived system.

	This patch is consistent with the patch to sccsid version 7.3 made
	by Berkeley.

Fix:
	Apply the attached patch to rcsid version 12.0 of ufs_syscalls.c.

*** ufs_syscalls.c	Mon Jul 10 15:05:08 1989
--- ufs_syscalls.c.orig	Mon Jul 10 15:03:52 1989
***************
*** 865,880 ****
  	if ((ip = owner(uap->fname, NOFOLLOW, rmt_simple_path, RT_chown, 
  						uap->uid, uap->gid)) == NULL)
  #else
! #ifdef UCBFIX
! /* This is UCBFIX 1.77, there are no other UCBFIX ifdef's in this file. */
! 	register struct nameidata *ndp = &u.u_nd;
! 
! 	ndp->ni_nameiop = LOOKUP | NOFOLLOW;
! 	ndp->ni_segflg = UIO_USERSPACE;
! 	ndp->ni_dirp = uap->fname;
! 	ip = namei(ndp);
! 	if (ip == NULL)
! #endif UCBFIX
  #endif
  		return;
  	u.u_error = chown1(ip, uap->uid, uap->gid);
--- 865,871 ----
  	if ((ip = owner(uap->fname, NOFOLLOW, rmt_simple_path, RT_chown, 
  						uap->uid, uap->gid)) == NULL)
  #else
! 	if ((ip = owner(uap->fname, NOFOLLOW)) == NULL)
  #endif
  		return;
  	u.u_error = chown1(ip, uap->uid, uap->gid);
***************
*** 940,955 ****
  		uid = ip->i_uid;
  	if (gid == -1)
  		gid = ip->i_gid;
! #ifdef UCBFIX
! /* This is UCBFIX 1.77, there are no other UCBFIX ifdef's in this file. */
! 	/*
! 	 * If we don't own the file, are trying to change the owner
! 	 * of the file, or are not a member of the target group,
! 	 * the caller must be superuser or the call fails.
! 	 */
! 	if ((u.u_uid != ip->i_uid || uid != ip->i_uid ||
! 	    !groupmember((gid_t)gid)) && !suser())
! #endif UCBFIX
  		return (u.u_error);
  #ifdef QUOTA
  	if (ip->i_uid == uid)		/* this just speeds things a little */
--- 931,939 ----
  		uid = ip->i_uid;
  	if (gid == -1)
  		gid = ip->i_gid;
! 	if (uid != ip->i_uid && !suser())
! 		return (u.u_error);
! 	if (gid != ip->i_gid && !groupmember((gid_t)gid) && !suser())
  		return (u.u_error);
  #ifdef QUOTA
  	if (ip->i_uid == uid)		/* this just speeds things a little */

Eric Brunner
uunet!ibmsupt!brunner


