ncurses/backport-CVE-2023-29491-mitigation.patch
2023-07-03 03:21:46 +00:00

44 lines
1.3 KiB
Diff

Backport of:
Author: Sven Joachim <svenjoac@gmx.de>
Description: Change the --disable-root-environ configure option behavior
By default, the --disable-root-environ option forbids program run by
the superuser to load custom terminfo entries. This patch changes
that to only restrict programs running with elevated privileges,
matching the behavior of the --disable-setuid-environ option
introduced in the 20230423 upstream patchlevel.
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034372#29
Bug: https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00018.html
Forwarded: not-needed
Last-Update: 2023-05-01
---
ncurses/tinfo/access.c | 2 --
1 file changed, 2 deletions(-)
Index: ncurses-6.2/ncurses/tinfo/access.c
===================================================================
--- ncurses-6.2.orig/ncurses/tinfo/access.c
+++ ncurses-6.2/ncurses/tinfo/access.c
@@ -171,15 +171,16 @@ _nc_is_file_path(const char *path)
NCURSES_EXPORT(int)
_nc_env_access(void)
{
+ int result = TRUE;
+
#if HAVE_ISSETUGID
if (issetugid())
- return FALSE;
+ result = FALSE;
#elif HAVE_GETEUID && HAVE_GETEGID
if (getuid() != geteuid()
|| getgid() != getegid())
- return FALSE;
+ result = FALSE;
#endif
- /* ...finally, disallow root */
- return (getuid() != ROOT_UID) && (geteuid() != ROOT_UID);
+ return result;
}
#endif