beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fixed uid/gid bound check regression (#1555)

Browse source
This commit is contained in:
mmetc 2022-05-23 09:46:39 +02:00 committed by GitHub
parent a7c7ea5712
commit 357899b83e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
pkg/csplugin/utils.go
View file

@ -82,32 +82,19 @@ func getPluginTypeAndSubtypeFromPath(path string) (string, string, error) {
}
func getProcessAttr(username string, groupname string) (*syscall.SysProcAttr, error) {
u, err := user.Lookup(username)
uid, err := getUID(username)
if err != nil {
return nil, err
}
g, err := user.LookupGroup(groupname)
gid, err := getGID(groupname)
if err != nil {
return nil, err
}
uid, err := strconv.ParseInt(u.Uid, 10, 32)
if err != nil {
return nil, err
}
if uid < 0 && uid > math.MaxInt32 {
return nil, fmt.Errorf("out of bound uid")
}
gid, err := strconv.ParseInt(g.Gid, 10, 32)
if err != nil {
return nil, err
}
if gid < 0 && gid > math.MaxInt32 {
return nil, fmt.Errorf("out of bound gid")
}
return &syscall.SysProcAttr{
Credential: &syscall.Credential{
Uid: uint32(uid),
Gid: uint32(gid),
Uid: uid,
Gid: gid,
},
}, nil
}