diff options
| -rw-r--r-- | liblock/lockmail.c | 8 | ||||
| -rw-r--r-- | maildrop/deliver.C | 8 | ||||
| -rw-r--r-- | maildrop/main.C | 42 | ||||
| -rw-r--r-- | maildrop/setgroupid.c | 6 | ||||
| -rw-r--r-- | maildrop/setgroupid.h | 2 | ||||
| -rw-r--r-- | sqwebmail/sqwebmail.c | 35 |
6 files changed, 73 insertions, 28 deletions
diff --git a/liblock/lockmail.c b/liblock/lockmail.c index a2c81ee..fda0799 100644 --- a/liblock/lockmail.c +++ b/liblock/lockmail.c @@ -159,8 +159,12 @@ int main(int argc, char **argv) if (pid == 0) { - setgid(getgid()); - setuid(getuid()); + if (setgid(getgid()) < 0 || + setuid(getuid()) < 0) + { + perror("setuid/setgid"); + exit(1); + } (void)caught(); execvp(argvec[0], argvec); diff --git a/maildrop/deliver.C b/maildrop/deliver.C index 82d3108..2d06d33 100644 --- a/maildrop/deliver.C +++ b/maildrop/deliver.C @@ -280,8 +280,12 @@ int n; for (n=0; n<NSIG; n++) signal(n, SIG_DFL); - setgroupid(getgid()); // Just in case. - setuid(getuid()); + if (setgroupid(getgid()) < 0 || + setuid(getuid()) < 0) + { + perror("setuid/setgid"); + _exit(100); + } ExitTrap::onfork(); execle(shell, q, "-c", cmd, (const char *)0, env); if (write (2, "Unable to execute ", 18) < 0 || diff --git a/maildrop/main.C b/maildrop/main.C index d144263..2311aab 100644 --- a/maildrop/main.C +++ b/maildrop/main.C @@ -259,7 +259,11 @@ static int callback_authlib(struct authinfo *auth, << b << "\n"; } - setgroupid(auth->sysgroupid); + if (setgroupid(auth->sysgroupid) < 0) + { + perror("setgid"); + exit(1); + } uid_t u; if (auth->sysusername) @@ -291,9 +295,8 @@ static int callback_authlib(struct authinfo *auth, << b << "\n"; } - setuid(u); - - if ( getuid() != u) + if (setuid(u) < 0 || + getuid() != u) nochangeuidgid(); if (VerboseLevel() > 1) @@ -479,12 +482,17 @@ const char *numuidgid=0; my_pw=getpwnam(deliverymode); if (!my_pw) nouser(); + if ( #if RESET_GID - setgroupid(my_pw->pw_gid); + setgroupid(my_pw->pw_gid) < 0 #else - setgroupid(getegid()); + setgroupid(getegid()) < 0 #endif - setuid(my_pw->pw_uid); + || + setuid(my_pw->pw_uid) < 0) + { + nochangeuidgid(); + } if (getuid() != my_pw->pw_uid) nochangeuidgid(); // Security violation. @@ -560,8 +568,12 @@ const char *numuidgid=0; throw "Invalid -D option."; } } - setgroupid(gn); - setuid(un); + if (setgroupid(gn) < 0 || + setuid(un) < 0) + { + perror("setuid/setgid"); + exit(1); + } deliverymode=""; orig_uid=un; /* See below for another Courier hook */ } @@ -570,12 +582,20 @@ const char *numuidgid=0; #if RESET_GID - setgroupid(getgid()); + if (setgroupid(getgid()) < 0) + { + perror("setgid"); + exit(1); + } #endif uid_t my_u=getuid(); - setuid(my_u); // Drop any setuid privileges. + if (setuid(my_u) < 0) // Drop any setuid privileges. + { + perror("setuid"); + exit(1); + } if (!found) { diff --git a/maildrop/setgroupid.c b/maildrop/setgroupid.c index 33820b0..574ea2e 100644 --- a/maildrop/setgroupid.c +++ b/maildrop/setgroupid.c @@ -1,13 +1,13 @@ #include "setgroupid.h" -void setgroupid(gid_t grpid) +int setgroupid(gid_t grpid) { -gid_t g=grpid; + gid_t g=grpid; #if HAVE_SETGROUPS setgroups(1, &g); #endif - setgid(g); + return setgid(g); } diff --git a/maildrop/setgroupid.h b/maildrop/setgroupid.h index eae7d6b..1add963 100644 --- a/maildrop/setgroupid.h +++ b/maildrop/setgroupid.h @@ -17,6 +17,6 @@ extern "C" #endif - void setgroupid(gid_t grpid); +int setgroupid(gid_t grpid); #endif diff --git a/sqwebmail/sqwebmail.c b/sqwebmail/sqwebmail.c index 3604568..8c4cfe1 100644 --- a/sqwebmail/sqwebmail.c +++ b/sqwebmail/sqwebmail.c @@ -2190,7 +2190,7 @@ int main(int argc, char **argv) static int setuidgid(uid_t u, gid_t g, const char *dir, void *dummy) { - if (setgid(g) || setuid(u)) + if (setgid(g) < 0 || setuid(u) < 0) { fprintf(stderr, "CRIT: Cache - can't setuid/setgid to %u/%u\n", @@ -2275,8 +2275,12 @@ time_t timeouthard=get_timeouthard(); if (*pi_malloced == 0) { free(pi_malloced); - setgid(getgid()); - setuid(getuid()); + if (setgid(getgid()) < 0 || + setuid(getuid()) < 0) + { + perror("setuid/setgid"); + exit(1); + } output_form("printnocookie.html"); return; } @@ -2360,8 +2364,12 @@ time_t timeouthard=get_timeouthard(); || last_time + timeoutsoft < current_time) { - setgid(getgid()); - setuid(getuid()); /* Drop root prevs */ + if (setgid(getgid()) < 0 || + setuid(getuid()) < 0) /* Drop root prevs */ + { + perror("setuid/setgid"); + exit(1); + } if (chdir("/") < 0) { output_form("expired.html"); @@ -2599,14 +2607,23 @@ time_t timeouthard=get_timeouthard(); maildir_cache_cancel(); free(ubuf); - setgid(getgid()); - setuid(getuid()); + if (setgid(getgid()) < 0 || + setuid(getuid()) < 0) /* Drop root prevs */ + { + perror("setuid/setgid"); + exit(1); + } output_form("invalid.html"); /* Invalid login */ return; } - setgid(getgid()); - setuid(getuid()); + if (setgid(getgid()) < 0 || + setuid(getuid()) < 0) /* Drop root prevs */ + { + perror("setuid/setgid"); + exit(1); + } + if ( *(u=cgi("redirect"))) /* Redirection request to hide the referral tag */ { |