summary refs log tree commit diff
path: root/gnu/packages/patches/rush-CVE-2013-6889.patch
blob: 862528a12c9fe71b0c592ed6b0561e8b27b6add5 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
commit 00bdccd429517f12dbf37ab4397ddec3e51a2738
Author: Mats Erik Andersson <gnu@gisladisker.se>
Date:   Mon Jan 20 13:33:52 2014 +0200

    Protect against CVE-2013-6889 (tiny change).
    
    Reset the effective user identification in testing mode.

diff --git a/src/rush.c b/src/rush.c
index 45d737a..dc6518e 100644
--- a/src/rush.c
+++ b/src/rush.c
@@ -980,6 +980,10 @@ main(int argc, char **argv)
 	} else if (argc > optind)
 		die(usage_error, NULL, _("invalid command line"));
 	
+	/* Relinquish root privileges in test mode */
+	if (lint_option)
+		setuid(getuid());
+	
 	if (test_user_name) {
 		struct passwd *pw = getpwnam(test_user_name);
 		if (!pw)