pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations 14/311114/1 accepted/tizen_base accepted/tizen_base_toolchain accepted/tizen_base_x accepted/tizen_base_x_asan tizen_base accepted/tizen/base/20240530.091900 accepted/tizen/base/toolchain/20240603.231421 accepted/tizen/base/x/20240526.035713 accepted/tizen/base/x/asan/20240624.231401
authorMatthias Gerstner <matthias.gerstner@suse.de>
Wed, 27 Dec 2023 13:01:59 +0000 (14:01 +0100)
committeryoungjae cho <y0.cho@samsung.com>
Tue, 14 May 2024 07:56:21 +0000 (07:56 +0000)
commitcd6b4c6779a335afbdc1825abda97af49ac293f8
treeb4d3e8e14233348d14398fc2cb4ee0154b4ae2c8
parent5b0f078ec372f810b832d0f261c68826fb97d4f9
pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations

(backporting, CVE-2024-22356)

Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
being placed in user controlled directories, causing the PAM module to
block indefinitely during `openat()`.

Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
refer to a directory.

With this the check whether the final path element is a directory
becomes unnecessary, drop it.

Original: upstream, https://github.com/linux-pam/linux-pam/commit/031bb5a
Change-Id: I099e6d7fa62446160babf79d41fb19bfbfe5b186
Signed-off-by: Youngjae Cho <y0.cho@samsung.com>
(cherry picked from commit cb1ff0632d1d392606509c46d8fd25271a715825)
modules/pam_namespace/pam_namespace.c