mirror of
https://git.tukaani.org/xz.git
synced 2025-05-03 12:56:45 +00:00
xz, xzdec: Capsicum sandbox: Fix incorrect use of cap_rights_clear()
cap_rights_clear() with no additional arguments acts as a no-op, so instead of removing all capability rights from STDIN_FILENO, the same rights were allowed for STDIN_FILENO as were allowed for src_fd. Fixes: a0eecc235d3b ("xz: Make Capsicum sandbox more strict with stdin and stdout.") (The commit message says "stdout". It should have said "stderr".) (cherry picked from commit 5cc2e479eb447a444f5ab005fc36b7f275c75eb5)
This commit is contained in:
parent
2e918d09ad
commit
00034e2506
@ -319,7 +319,7 @@ sandbox_enable_strict_if_allowed(
|
||||
|
||||
// If not reading from stdin, remove all capabilities from it.
|
||||
if (src_fd != STDIN_FILENO && cap_rights_limit(
|
||||
STDIN_FILENO, cap_rights_clear(&rights)))
|
||||
STDIN_FILENO, cap_rights_init(&rights)))
|
||||
goto error;
|
||||
|
||||
if (cap_rights_limit(STDOUT_FILENO, cap_rights_init(&rights,
|
||||
|
@ -316,7 +316,7 @@ sandbox_enter(int src_fd)
|
||||
|
||||
// If not reading from stdin, remove all capabilities from it.
|
||||
if (src_fd != STDIN_FILENO && cap_rights_limit(
|
||||
STDIN_FILENO, cap_rights_clear(&rights)))
|
||||
STDIN_FILENO, cap_rights_init(&rights)))
|
||||
goto error;
|
||||
|
||||
if (cap_rights_limit(STDOUT_FILENO, cap_rights_init(&rights,
|
||||
|
Loading…
x
Reference in New Issue
Block a user