From a0eecc235d3ba8ad3453da98b46c7bc3e644de75 Mon Sep 17 00:00:00 2001 From: Lasse Collin Date: Tue, 7 Mar 2023 19:59:23 +0200 Subject: xz: Make Capsicum sandbox more strict with stdin and stdout. --- src/xz/file_io.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/xz/file_io.c b/src/xz/file_io.c index 37710428..ca452cdc 100644 --- a/src/xz/file_io.c +++ b/src/xz/file_io.c @@ -199,11 +199,19 @@ io_sandbox_enter(int src_fd) CAP_EVENT, CAP_FCNTL, CAP_LOOKUP, CAP_READ, CAP_SEEK))) goto capsicum_error; + if (src_fd != STDIN_FILENO && cap_rights_limit( + STDIN_FILENO, cap_rights_clear(&rights))) + goto capsicum_error; + if (cap_rights_limit(STDOUT_FILENO, cap_rights_init(&rights, CAP_EVENT, CAP_FCNTL, CAP_FSTAT, CAP_LOOKUP, CAP_WRITE, CAP_SEEK))) goto capsicum_error; + if (cap_rights_limit(STDERR_FILENO, cap_rights_init(&rights, + CAP_WRITE))) + goto capsicum_error; + if (cap_rights_limit(user_abort_pipe[0], cap_rights_init(&rights, CAP_EVENT))) goto capsicum_error; -- cgit v1.2.3