* NEWS, libmisc/chowntty.c: Fix a race condition that could lead

	to gaining ownership or changing mode of arbitrary files.

diff --git a/ChangeLog b/ChangeLog
index dca5b52e1350956f2c3a456e9f3bc9ac61d15bb2..0c0d5d59515b724db855517f4c036a31a2095ccc 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2008-11-23  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * NEWS, libmisc/chowntty.c: Fix a race condition that could lead
+       to gaining ownership or changing mode of arbitrary files.
+
 2008-06-26  Nicolas François  <nicolas.francois@centraliens.net>
 
        Prepare the 4.1.2.1 release

diff --git a/NEWS b/NEWS
index 4ab3ee776e961203bb946d72501d83eacaa7f3dd..8afcf03e69a8a52df36ad7bd0000beef942b6a63 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,11 @@
 $Id$
 
+shadow-4.1.2.1 -> shadow-4.1.2.2                                       23-11-2008
+
+*** security
+- Fix a race condition in login that could lead to gaining ownership or
+  changing mode of arbitrary files.
+
 shadow-4.1.2 -> shadow-4.1.2.1                                         26-06-2008
 
 *** security

diff --git a/libmisc/chowntty.c b/libmisc/chowntty.c
index fcfad917801421d688ff86e0c624a6104d5913d0..745ee8a3de96b7116993e1d49d59eb21a305bf39 100644 (file)
--- a/libmisc/chowntty.c
+++ b/libmisc/chowntty.c
@@ -2,7 +2,7 @@
  * Copyright (c) 1989 - 1994, Julianne Frances Haugh
  * Copyright (c) 1996 - 2001, Marek Michałkiewicz
  * Copyright (c) 2003 - 2005, Tomasz Kłoczko
- * Copyright (c) 2007       , Nicolas François
+ * Copyright (c) 2007 - 2008, Nicolas François
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -102,14 +102,14 @@ void chown_tty (const char *tty, const struct passwd *info)
                exit (1);
        }
 
-       if (chown (tty, info->pw_uid, gid) ||
-           chmod (tty, getdef_num ("TTYPERM", 0600))) {
+       if (fchown (STDIN_FILENO, info->pw_uid, gid) ||
+           fchmod (STDIN_FILENO, getdef_num ("TTYPERM", 0600))) {
                int err = errno;
 
-               snprintf (buf, sizeof buf, _("Unable to change tty %s"), tty);
+               snprintf (buf, sizeof buf, _("Unable to change tty stdin"));
                perror (buf);
                SYSLOG ((LOG_WARN,
-                        "unable to change tty `%s' for user `%s'\n", tty,
+                        "unable to change tty stdin for user `%s'\n",
                         info->pw_name));
                closelog ();