From 47ff3287ebb377f3640b7b3dfdd5d2fd370eb38c Mon Sep 17 00:00:00 2001 From: Ronald Chan Date: Wed, 20 Nov 2013 22:25:36 +1300 Subject: [PATCH 1/2] close metafile to prevent box_inside writing false data to it - see https://github.com/ronalchn/isolate-cheater --- isolate/isolate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/isolate/isolate.c b/isolate/isolate.c index e000660..2079774 100644 --- a/isolate/isolate.c +++ b/isolate/isolate.c @@ -1127,6 +1127,7 @@ box_inside(void *arg) char **args = arg; write_errors_to_fd = error_pipes[1]; close(error_pipes[0]); + meta_close(); cg_enter(); setup_root(); From 981f9da71b785972ffcf85602727ce77d43e70f4 Mon Sep 17 00:00:00 2001 From: Ronald Chan Date: Thu, 21 Nov 2013 14:12:23 +1300 Subject: [PATCH 2/2] drop root privileges, use real user id to open metafile - security issue - can be used for privilege escalation attacks for users permitted to execute isolate --- isolate/isolate.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/isolate/isolate.c b/isolate/isolate.c index 2079774..aa999df 100644 --- a/isolate/isolate.c +++ b/isolate/isolate.c @@ -91,7 +91,9 @@ meta_open(const char *name) metafile = stdout; return; } + setreuid(geteuid(), getuid()); metafile = fopen(name, "w"); + setreuid(geteuid(), getuid()); if (!metafile) die("Failed to open metafile '%s'",name); }