Changeset 936

Timestamp:

Jan 5, 2009, 4:39:56 AM (17 years ago)

Author:

andersk

Message:

Prevent users other than afsagent and root from retrieving the global
PAG's tokens into userspace (ouch!).

File:

• server/common/patches/openafs-scripts.patch (modified) (1 diff)

server/common/patches/openafs-scripts.patch

@@ -127 +127 @@
      if (!afs_resourceinit_flag) {
         return EIO;
+@@ -1804,6 +1804,10 @@
+     afs_int32 iterator;
+     int newStyle;
+ 
++    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID &&
++       areq->realuid != 0)
++       return 0;
++
+     AFS_STATCNT(PGetTokens);
+     if (!afs_resourceinit_flag)        /* afs daemons haven't started yet */
+        return EIO;             /* Inappropriate ioctl for device */
 @@ -1870,6 +1878,10 @@
      register afs_int32 i;