Ticket #13631: python-2.7.3.p2.diff

File python-2.7.3.p2.diff, 2.1 KB (added by jdemeyer, 8 years ago)

Diff for the python spkg. For reference / review only.

  • SPKG.txt 

    # HG changeset patch
# User Jeroen Demeyer <jdemeyer@cage.ugent.be>
# Date 1351545665 -3600
# Node ID ba32bad781d4168138021df319db41ab65d5f3c8
# Parent  dd3260fd0af1959ea1266ee02c1d6f343d13ee3c
Trac #13631: Keep in mind umask when checking security of "python -c"

diff --git a/SPKG.txt b/SPKG.txt
    a b  
    6363
    6464== Changelog ==
    6565
     66=== python-2.7.3.p2 (Jeroen Demeyer, 29 October 2012) ===
     67 * Trac #13631: Keep in mind umask when checking security of "python -c"
     68
    6669=== python-2.7.3.p1 (Jeroen Demeyer, 14 October 2012) ===
    6770 * Trac #13579: add sys_path_security.patch.
    6871

  • patches/sys_path_security.patch 

    diff --git a/patches/sys_path_security.patch b/patches/sys_path_security.patch
    a b  
    11diff -ru src/Python/sysmodule.c b/Python/sysmodule.c
    22--- src/Python/sysmodule.c      2012-04-10 01:07:35.000000000 +0200
    3 +++ b/Python/sysmodule.c        2012-10-15 22:56:39.167513055 +0200
     3+++ b/Python/sysmodule.c        2012-10-29 22:18:46.337514322 +0100
    44@@ -46,6 +46,10 @@
    55 #include <langinfo.h>
    66 #endif
    … …  
    152152 #endif /* RISCOS */
    153153 #if SEP == '/' /* Special case for Unix filename syntax */
    154154             if (n > 1)
    155 @@ -1691,12 +1688,139 @@
     155@@ -1691,12 +1688,146 @@
    156156 #endif /* Unix */
    157157         }
    158158 #endif /* All others */
    … …  
    202202+            arg_stat.st_mode |= parent_stat.st_mode;
    203203+    } else {
    204204+        /* given_arg was "" or stat() failed, manually set relevant
    205 +         * stat members to safe values. */
    206 +        arg_stat.st_mode = 0644;
     205+         * stat members to sensible values.  Set the mode to whatever
     206+         * it would be if we would create a new file, keeping in mind
     207+         * the current umask. */
     208+        unsigned int mask = umask(0777); umask(mask);
     209+        arg_stat.st_mode = 0666 & ~mask;
    207210+        arg_stat.st_uid = 0;
     211+        /* Only keep group bit if the current group ID is the same as
     212+         * the group of "parent" */
     213+        if (getgid() != parent_stat.st_gid)
     214+            arg_stat.st_mode &= 0707;
    208215+    }
    209216+
    210217+    if (stat(Py_GetProgramFullPath(), &program_stat) == 0) {