Re: Suspicious code in uid16?

From: Chris Wing (wingc@engin.umich.edu)
Date: Tue Jan 11 2000 - 18:26:19 EST


Pauline:

> Every function correctly uses the high2lowgid and low2highgid
> stuff correctly, except those 2. I presume the array we read
> /write from user space contains 16 bits gids, so they must
> be converted to 32 bit gids, yes?

Yes, that's what the wrappers for setgroups and getgroups do:

asmlinkage long sys_getgroups16(int gidsetsize, old_gid_t *grouplist)
{
        old_gid_t groups[NGROUPS]; <---- a 16-bit integer type

...

                for(j=0;j<i;j++)
                        groups[j] = current->groups[j];
                if (copy_to_user(grouplist, groups, sizeof(old_gid_t)*i))
                        return -EFAULT;

...

You're right, I should have put high2lowgid() there. Thanks for pointing
this out.

> I'm also puzzled by the sys_setuid16() and sys_setgid16() functions,
> but I assume the high/low functions are not needed here, since
> the -1 value has no special meaning here?
>
> Hmmm, come to think of it, the group function have probably the
> same reasoning?

Yep, low2highuid() and low2highgid() are only needed for system calls that
interpreted -1 as having a special meaning before. These are:

        chown(), fchown(), lchown(), setreuid(), setregid(),
        setresuid(), setresgid()

I overlooked this fact when I was first writing a 32-bit UID patch (for
Linux 2.0 over a year ago), and noticed that the old set-uid root xterm
didn't work :)

Thanks,
Chris Wing
wingc@engin.umich.edu

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Jan 15 2000 - 21:00:19 EST