From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2155) id A9691385841B; Sat, 24 Feb 2024 12:13:45 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A9691385841B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1708776825; bh=ORfTxXzMrYYfHpVnhuZ2wlRQbMWLbM2bzCPg8ZBuqBQ=; h=From:To:Subject:Date:From; b=wl2icga5OWC3Kb1o/WyIh1jgVwLtah6dMoN8iQl2noj7DMCfskDz59Zex6C1VrUzb /pau+ENsVNBEsQvy4FvW3TLORmHBLaaQOJyMylevkdqGUo2JyF5A1HNFtVeQnxWCp2 3vmDPzq9h4Sinw3J8eju1Rl/tFDCnAGgtdaa4jJg= Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Corinna Vinschen To: cygwin-cvs@sourceware.org Subject: [newlib-cygwin/cygwin-3_5-branch] Cygwin: newgrp: only allow group from supplementary group list X-Act-Checkin: newlib-cygwin X-Git-Author: Corinna Vinschen X-Git-Refname: refs/heads/cygwin-3_5-branch X-Git-Oldrev: 08df2e23a75190fced8c1a2446ebaee4f469eb96 X-Git-Newrev: 32024ec7f723112a46dae8c7ff17b5ec1157021e Message-Id: <20240224121345.A9691385841B@sourceware.org> Date: Sat, 24 Feb 2024 12:13:45 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=3Dnewlib-cygwin.git;h=3D32024ec7f72= 3112a46dae8c7ff17b5ec1157021e commit 32024ec7f723112a46dae8c7ff17b5ec1157021e Author: Corinna Vinschen AuthorDate: Sat Feb 24 12:59:28 2024 +0100 Commit: Corinna Vinschen CommitDate: Sat Feb 24 13:12:37 2024 +0100 Cygwin: newgrp: only allow group from supplementary group list =20 Windows only allows to set the primary group to a group already present in the TOKEN_GROUP list. Cygwin OTOH fakes success at setgid() time, to allow a subsequent call to setuid() to do the actual account switching. To have a sane behaviour in the command line tool, check group membership and disallow to switch to groups other than those already present in the user token. =20 Fixes: 8bd56ec873453 ("Cygwin: newgrp: first full version") Signed-off-by: Corinna Vinschen Diff: --- winsup/doc/utils.xml | 8 +++----- winsup/utils/newgrp.c | 24 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 5 deletions(-) diff --git a/winsup/doc/utils.xml b/winsup/doc/utils.xml index 692dae38f5b4..aae1ba643364 100644 --- a/winsup/doc/utils.xml +++ b/winsup/doc/utils.xml @@ -2116,11 +2116,9 @@ D: on /d type fat (binary,user,noumount) has been given as argument, a command and its arguments can be specified on the command line. =20 - Please note that setting the primary group to any arbitrary gr= oup - is no privileged operation on Windows. However, even if this grou= p is - not in your current user token, or if the group is in your user token - but marked as deny-only, no additional permissions - can be obtained by setting this group as primary group. + The new primary group must be either the old primary group, or + it must be part of the supplementary group list. Setting the prim= ary + group to an arbitrary group is not allowed in Windows. =20 diff --git a/winsup/utils/newgrp.c b/winsup/utils/newgrp.c index e312a3c51d38..414e8cdf8edc 100644 --- a/winsup/utils/newgrp.c +++ b/winsup/utils/newgrp.c @@ -136,6 +136,7 @@ main (int argc, const char **argv) char **child_env; bool new_child_env =3D false; gid_t gid; + int ngrps; =20 setlocale (LC_ALL, ""); =20 @@ -176,6 +177,29 @@ main (int argc, const char **argv) ++argv; } =20 + /* Windows does not allow to set the primary group to another group if + it's not already part of the supplementary group list. However, our + setgid() allows this, otherwise OpenSSH and other account-switching + processes wouldn't work, given we only actually switch the user + context at setuid() time. Therefore we test this here and don't + allow other groups. */ + ngrps =3D getgroups (0, NULL); + if (ngrps > 0) + { + gid_t *glist =3D (gid_t *) alloca (ngrps * sizeof (gid_t)); + + ngrps =3D getgroups (ngrps, glist); + while (--ngrps >=3D 0) + if (gid =3D=3D glist[ngrps]) + break; + if (ngrps < 0) + { + fprintf (stderr, "%s: can't switch primary group to '%s'\n", + program_invocation_short_name, gr->gr_name); + return 2; + } + } + /* Set primary group */ if (setgid (gid) !=3D 0) {