From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 4 Dec 2017 16:09:27 +0000 (+0100)
Subject: journal,coredump: do not do ACL magic for "nobody" user either
X-Git-Tag: v236~56^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=05fd2156b7bdb31eec1731b289e80dca56acd13c;p=thirdparty%2Fsystemd.git

journal,coredump: do not do ACL magic for "nobody" user either

The "nobody" user might possibly be seen by the journal or coredumping
code if unmapped userns-using processes are somehow visible to them.
Let's make sure we don't do the ACL magic for this user either, since
this is a special system user that might be backed by different real
users in different contexts.
---

diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index cf56a8ad267..ead04d4ee15 100644
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -165,7 +165,7 @@ static int fix_acl(int fd, uid_t uid) {
 
         assert(fd >= 0);
 
-        if (uid_is_system(uid) || uid_is_dynamic(uid))
+        if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY)
                 return 0;
 
         /* Make sure normal users can read (but not write or delete)
diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
index 06c64a46e2e..3da3dad2309 100644
--- a/src/journal/journald-server.c
+++ b/src/journal/journald-server.c
@@ -248,7 +248,7 @@ static void server_add_acls(JournalFile *f, uid_t uid) {
         assert(f);
 
 #if HAVE_ACL
-        if (uid_is_system(uid) || uid_is_dynamic(uid))
+        if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY)
                 return;
 
         r = add_acls_for_user(f->fd, uid);
@@ -406,7 +406,7 @@ static JournalFile* find_journal(Server *s, uid_t uid) {
         if (s->runtime_journal)
                 return s->runtime_journal;
 
-        if (uid_is_system(uid) || uid_is_dynamic(uid))
+        if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY)
                 return s->system_journal;
 
         r = sd_id128_get_machine(&machine);