luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-03-28 18:40:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

gresource: Ignore G_RESOURCE_OVERLAYS when running as setuid

Browse Source 
It could have been used to load private data which would not normally be
accessible to an unprivileged caller.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

Helps: #2168
This commit is contained in:
Philip Withnall 2020-12-04 23:40:12 +00:00
parent 661ae020bd
commit 55233b6e14
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
gio/gresource.c
View File

@ -32,6 +32,8 @@
#include <gio/gzlibdecompressor.h>
#include <gio/gconverterinputstream.h>
#include "glib-private.h"
struct _GResource
{
int ref_count;
@ -159,7 +161,7 @@ G_DEFINE_BOXED_TYPE (GResource, g_resource, g_resource_ref, g_resource_unref)
* replace resources in the program or library, without recompiling, for debugging or quick hacking and testing
* purposes. Since GLib 2.50, it is possible to use the `G_RESOURCE_OVERLAYS` environment variable to selectively overlay
* resources with replacements from the filesystem. It is a %G_SEARCHPATH_SEPARATOR-separated list of substitutions to perform
* during resource lookups.
* during resource lookups. It is ignored when running in a setuid process.
*
* A substitution has the form
*
@ -330,10 +332,13 @@ g_resource_find_overlay (const gchar *path,
if (g_once_init_enter (&overlay_dirs))
{
gboolean is_setuid = GLIB_PRIVATE_CALL (g_check_setuid) ();
const gchar * const *result;
const gchar *envvar;
envvar = g_getenv ("G_RESOURCE_OVERLAYS");
/* Don’t load overlays if setuid, as they could allow reading privileged
* files. */
envvar = !is_setuid ? g_getenv ("G_RESOURCE_OVERLAYS") : NULL;
if (envvar != NULL)
{
gchar **parts;