more: drop setuid permissions before executing anything

Pagers are not expected to have setuid or setgid bits, but assuming such
mistake has taken place try to avoid privilege escalation.

Signed-off-by: Sami Kerola <kerolasa@iki.fi>

diff --git a/text-utils/more.c b/text-utils/more.c
index f061e12fd277a74c98263768e17dff577bad4e5e..f6a59e48682d29a1fb231a3e8acbe65c14804127 100644 (file)
--- a/text-utils/more.c
+++ b/text-utils/more.c
@@ -1118,6 +1118,13 @@ static void execute(struct more_control *ctl, char *filename, char *cmd, ...)
                }
                va_end(argp);
 
+               if (geteuid() != getuid() || getegid() != getgid()) {
+                       if (setuid(getuid()) < 0)
+                               err(EXIT_FAILURE, _("setuid failed"));
+                       if (setgid(getgid()) < 0)
+                               err(EXIT_FAILURE, _("setgid failed"));
+               }
+
                execvp(cmd, args);
                errsv = errno;
                fputs(_("exec failed\n"), stderr);