[gentoo-commits] proj/sandbox:master commit in: libsandbox/

[Michał Górny]

commit:     96374d9bff64bcee64340f6572cca9f1cc3f696d
Author:     Mike Gilbert <floppym <AT> gentoo <DOT> org>
AuthorDate: Tue Jun  8 15:08:54 2021 +0000
Commit:     Michał Górny <mgorny <AT> gentoo <DOT> org>
CommitDate: Tue Sep  7 15:31:07 2021 +0000
URL:        https://gitweb.gentoo.org/proj/sandbox.git/commit/?id=96374d9b

libsandbox: adjust hard-coded denial for /var/log/sandbox

Move this hack after the read checks, but before the write checks. This
allows processes to read the log directory, but not write to it.

This is helpful in case a process does something like this:

  find /var/log -name system.journal

Bug: https://bugs.gentoo.org/794949
Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org>
Closes: https://bugs.gentoo.org/794949
Signed-off-by: Michał Górny <mgorny <AT> gentoo.org>

 libsandbox/libsandbox.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/libsandbox/libsandbox.c b/libsandbox/libsandbox.c
index 3d55dd7..758c0dc 100644
--- a/libsandbox/libsandbox.c
+++ b/libsandbox/libsandbox.c
@@ -714,15 +714,6 @@ static int check_access(sbcontext_t *sbcontext, int sb_nr, const char *func,
 			goto out;
 	}
 
-	/* Hardcode denying write to the whole log dir.  While this is a
-	 * parial match and so rejects paths that also start with this
-	 * string, that isn't going to happen in real life so live with
-	 * it.  We can't append a slash to this path either as that would
-	 * allow people to open the dir itself for writing.
-	 */
-	if (!strncmp(resolv_path, SANDBOX_LOG_LOCATION, strlen(SANDBOX_LOG_LOCATION)))
-		goto out;
-
 	if (sbcontext->read_prefixes &&
 	    (sb_nr == SB_NR_ACCESS_RD ||
 	     sb_nr == SB_NR_OPEN_RD   ||
@@ -754,6 +745,15 @@ static int check_access(sbcontext_t *sbcontext, int sb_nr, const char *func,
 		}
 	}
 
+	/* Hardcode denying write to the whole log dir.  While this is a
+	 * parial match and so rejects paths that also start with this
+	 * string, that isn't going to happen in real life so live with
+	 * it.  We can't append a slash to this path either as that would
+	 * allow people to open the dir itself for writing.
+	 */
+	if (!strncmp(resolv_path, SANDBOX_LOG_LOCATION, strlen(SANDBOX_LOG_LOCATION)))
+		goto out;
+
 	if (sb_nr == SB_NR_ACCESS_WR   ||
 	    sb_nr == SB_NR_CHMOD       ||
 	    sb_nr == SB_NR_CHOWN       ||