proxy_child hardening

[sssd-bot]

Cloned from Pagure issue: https://pagure.io/SSSD/sssd/issue/2689

• Created at 2015-06-23 17:16:11 by fweimer
• Assigned to atikhonov

---

proxy_child should perform chdir("/"), umask(022) (or equivalent, but not 0), and reset the environment (with clearenv(), or some more careful approach if there are environment dependencies).

The --domain argument should be sanitized, currently funny names such as /../foo are accepted.

All this just seems to be hardening, no imminent security impact.

Comments

---

Comment from jhrozek at 2015-06-25 15:52:07

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.15 beta

---

Comment from jhrozek at 2015-07-20 22:28:11

Fields changed

rhbz: => 0

---

Comment from lslebodn at 2015-08-17 12:59:44

It should be a similar fix to #2754
plus additional hardening to the argument "--domain"

owner: somebody => pcech

---

Comment from fweimer at 2017-02-24 14:23:39

Metadata Update from @fweimer:

• Issue assigned to pcech
• Issue set to the milestone: SSSD Future releases (no date set yet)

---

Comment from amitkumar25nov at 2018-05-23 09:01:33

#578

---

Comment from atikhonov at 2019-10-24 15:01:37

Metadata Update from @atikhonov:

• Custom field design_review reset (from 0)
• Custom field mark reset (from 0)
• Custom field patch reset (from 0)
• Custom field review reset (from 0)
• Custom field sensitive reset (from 0)
• Custom field testsupdated reset (from 0)
• Issue assigned to atikhonov (was: pcech)
• Issue close_status updated to: None

---

Comment from thalman at 2020-03-11 15:18:53

Metadata Update from @thalman:

• Custom field design_review reset (from false)
• Custom field mark reset (from false)
• Custom field patch reset (from false)
• Custom field review reset (from false)
• Custom field sensitive reset (from false)
• Custom field testsupdated reset (from false)
• Issue tagged with: Next milestone

[pbrezina]

Pushed PR: #5268

• master
  • b6fc7c0 - Sanitize --domain option to allow safe usage as a part of log file name
  • 3986dea - PROXY: child process security hardening