Skip to content

Commit c29557d

Browse files
author
John C. Frickson
committed
Merge branch 'maint'
2 parents bc90881 + 8e6e1cb commit c29557d

File tree

3 files changed

+51
-6
lines changed

3 files changed

+51
-6
lines changed

Diff for: Changelog

+6
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22
Nagios Core 4 Change Log
33
########################
44

5+
4.2.x - xxxx-xx-xx
6+
------------------
7+
SECURITY FIXES
8+
* Fixed another root privilege escalation (CVE-2016-9566) Thanks for bringing this
9+
to our attention go to Dawid Golunski (http://legalhackers.com).
10+
511

612
4.2.3 - 2016-11-21
713
-------------------

Diff for: THANKS

+1
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ wrong, please let me know.
7070
* David Kmoch
7171
* David Schlecht
7272
* David Tilloy
73+
* Dawid Golunski
7374
* Dean Lane
7475
* Denis Seleznyov
7576
* Dennis Biringer

Diff for: base/logging.c

+44-6
Original file line numberDiff line numberDiff line change
@@ -112,17 +112,39 @@ static void write_to_all_logs_with_timestamp(char *buffer, unsigned long data_ty
112112

113113
static FILE *open_log_file(void)
114114
{
115+
int fh;
116+
struct stat st;
117+
115118
if(log_fp) /* keep it open unless we rotate */
116119
return log_fp;
117120

118-
log_fp = fopen(log_file, "a+");
121+
if ((fh = open(log_file, O_RDWR|O_APPEND|O_CREAT|O_NOFOLLOW, S_IRUSR|S_IWUSR)) == -1) {
122+
if (daemon_mode == FALSE)
123+
printf("Warning: Cannot open log file '%s' for writing\n", log_file);
124+
return NULL;
125+
}
126+
log_fp = fdopen(fh, "a+");
119127
if(log_fp == NULL) {
120-
if (daemon_mode == FALSE) {
128+
if (daemon_mode == FALSE)
121129
printf("Warning: Cannot open log file '%s' for writing\n", log_file);
122-
}
123130
return NULL;
124131
}
125132

133+
if ((fstat(fh, &st)) == -1) {
134+
log_fp = NULL;
135+
close(fh);
136+
if (daemon_mode == FALSE)
137+
printf("Warning: Cannot fstat log file '%s'\n", log_file);
138+
return NULL;
139+
}
140+
if (st.st_nlink != 1 || (st.st_mode & S_IFMT) != S_IFREG) {
141+
log_fp = NULL;
142+
close(fh);
143+
if (daemon_mode == FALSE)
144+
printf("Warning: log file '%s' has an invalid mode\n", log_file);
145+
return NULL;
146+
}
147+
126148
(void)fcntl(fileno(log_fp), F_SETFD, FD_CLOEXEC);
127149
return log_fp;
128150
}
@@ -447,7 +469,10 @@ int write_log_file_info(time_t *timestamp) {
447469

448470

449471
/* opens the debug log for writing */
450-
int open_debug_log(void) {
472+
int open_debug_log(void)
473+
{
474+
int fh;
475+
struct stat st;
451476

452477
/* don't do anything if we're not actually running... */
453478
if(verify_config || test_scheduling == TRUE)
@@ -457,10 +482,23 @@ int open_debug_log(void) {
457482
if(debug_level == DEBUGL_NONE)
458483
return OK;
459484

460-
if((debug_file_fp = fopen(debug_file, "a+")) == NULL)
485+
if ((fh = open(debug_file, O_RDWR|O_APPEND|O_CREAT|O_NOFOLLOW, S_IRUSR|S_IWUSR)) == -1)
486+
return ERROR;
487+
if((debug_file_fp = fdopen(fh, "a+")) == NULL)
488+
return ERROR;
489+
490+
if ((fstat(fh, &st)) == -1) {
491+
debug_file_fp = NULL;
492+
close(fh);
493+
return ERROR;
494+
}
495+
if (st.st_nlink != 1 || (st.st_mode & S_IFMT) != S_IFREG) {
496+
debug_file_fp = NULL;
497+
close(fh);
461498
return ERROR;
499+
}
462500

463-
(void)fcntl(fileno(debug_file_fp), F_SETFD, FD_CLOEXEC);
501+
(void)fcntl(fh, F_SETFD, FD_CLOEXEC);
464502

465503
return OK;
466504
}

0 commit comments

Comments
 (0)