diff options
| author | Matthias Gerstner <matthias.gerstner@suse.de> | 2023-12-27 14:01:59 +0100 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@strace.io> | 2024-01-17 08:00:00 +0000 |
| commit | 031bb5a5d0d950253b68138b498dc93be69a64cb (patch) | |
| tree | 0b91bcf3c48fe9806e76dcfb64c17ee885e4672d /NEWS | |
| parent | cf8c50f2c76fd29c018a2220d243f41801aaadb1 (diff) | |
| download | pam-031bb5a5d0d950253b68138b498dc93be69a64cb.tar.gz pam-031bb5a5d0d950253b68138b498dc93be69a64cb.tar.bz2 pam-031bb5a5d0d950253b68138b498dc93be69a64cb.zip | |
pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations
Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
being placed in user controlled directories, causing the PAM module to
block indefinitely during `openat()`.
Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
refer to a directory.
With this the check whether the final path element is a directory
becomes unnecessary, drop it.
Diffstat (limited to 'NEWS')
0 files changed, 0 insertions, 0 deletions