Isolate: Create meta files with permissions of the user invoking isolate

Otherwise, it can be misused for privilege escalation attacks.

The problem has been noted by Ronald Chan, but my fix differs from his.

diff --git a/isolate/isolate.c b/isolate/isolate.c
index 2164c9087bc448f6d70a1f8d45a2af1e759288ae..4fc6d05d0a7a9d4d74fe2f42fb92904011331f7f 100644 (file)
--- a/isolate/isolate.c
+++ b/isolate/isolate.c
@@ -32,6 +32,7 @@
 #include <sys/stat.h>
 #include <sys/quota.h>
 #include <sys/vfs.h>
+#include <sys/fsuid.h>
 
 #define NONRET __attribute__((noreturn))
 #define UNUSED __attribute__((unused))
@@ -94,7 +95,11 @@ meta_open(const char *name)
       metafile = stdout;
       return;
     }
+  if (setfsuid(getuid()) < 0)
+    die("Failed to switch FS UID: %m");
   metafile = fopen(name, "w");
+  if (setfsuid(geteuid()) < 0)
+    die("Failed to switch FS UID back: %m");
   if (!metafile)
     die("Failed to open metafile '%s'",name);
 }