summaryrefslogtreecommitdiff
authorColin Walters <walters@verbum.org>2012-09-14 09:21:28 (GMT)
committer Christophe Fergeau <cfergeau@redhat.com>2012-09-14 09:21:44 (GMT)
commitefbf867bb88845d5edf839550b54494b1bb752b9 (patch) (side-by-side diff)
treea2aa4ee5cc54aa41613d0e008972157a81be6834
parent78ad29f5d891d8a63420f2abce822fc71111bb34 (diff)
downloadspice-gtk-efbf867bb88845d5edf839550b54494b1bb752b9.zip
spice-gtk-efbf867bb88845d5edf839550b54494b1bb752b9.tar.gz
usb-acl-helper: Clear environment
Otherwise we can be subject to attack via environment variables such as DBUS_SYSTEM_BUS_ADDRESS. This addresses CVE-2012-4425 http://seclists.org/oss-sec/2012/q3/470
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--configure.ac2
-rw-r--r--gtk/spice-client-glib-usb-acl-helper.c24
2 files changed, 25 insertions, 1 deletions
diff --git a/configure.ac b/configure.ac
index 4a220d1..c7367cc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -244,6 +244,8 @@ else
EXTERNAL_PNP_IDS="$with_pnp_ids_path"
fi
+AC_CHECK_FUNCS(clearenv)
+
PKG_CHECK_MODULES(GLIB2, glib-2.0 >= 2.22)
AC_SUBST(GLIB2_CFLAGS)
AC_SUBST(GLIB2_LIBS)
diff --git a/gtk/spice-client-glib-usb-acl-helper.c b/gtk/spice-client-glib-usb-acl-helper.c
index 724d62a..93b9b3a 100644
--- a/gtk/spice-client-glib-usb-acl-helper.c
+++ b/gtk/spice-client-glib-usb-acl-helper.c
@@ -158,7 +158,8 @@ static void cleanup(void)
if (state == STATE_WAITING_FOR_STDIN_EOF)
set_facl(path, getuid(), 0);
- g_main_loop_quit(loop);
+ if (loop)
+ g_main_loop_quit(loop);
}
/* Not available in polkit < 0.101 */
@@ -311,11 +312,32 @@ polkit_authority_get_sync (GCancellable *cancellable, GError **error)
}
#endif
+#ifndef HAVE_CLEARENV
+extern char **environ;
+
+static int
+clearenv (void)
+{
+ if (environ != NULL)
+ environ[0] = NULL;
+ return 0;
+}
+#endif
+
int main(void)
{
pid_t parent_pid;
GInputStream *stdin_unix_stream;
+ /* Nuke the environment to get a well-known and sanitized
+ * environment to avoid attacks via e.g. the DBUS_SYSTEM_BUS_ADDRESS
+ * environment variable and similar.
+ */
+ if (clearenv () != 0) {
+ FATAL_ERROR("Error clearing environment: %s\n", g_strerror (errno));
+ return 1;
+ }
+
g_type_init();
loop = g_main_loop_new(NULL, FALSE);