chiark / gitweb /
dynamic-user: don't use a UID that currently owns IPC objects (#6962)
authorLennart Poettering <lennart@poettering.net>
Wed, 4 Oct 2017 19:40:01 +0000 (21:40 +0200)
committerSven Eden <yamakuzure@gmx.net>
Fri, 8 Dec 2017 06:35:48 +0000 (07:35 +0100)
commit8c0e8795b87e23c161a1847ce67b28bea33328f8
tree79f7fde083ceaf8b70ca3234f803b1cca52f3588
parentf36e6ba9b25ae3767247baf079361afc61fa88a2
dynamic-user: don't use a UID that currently owns IPC objects (#6962)

This fixes a mostly theoretical potential security hole: if for some
reason we failed to remove IPC objects created for a dynamic user (maybe
because a MAC/SElinux erronously prohibited), then we should not hand
out the same UID again until they are successfully removed.

With this commit we'll enumerate the IPC objects currently existing, and
step away from using a UID for the dynamic UID logic if there are any
matching it.
src/shared/clean-ipc.c
src/shared/clean-ipc.h