diff options
| author | Florian Weimer <fweimer@redhat.com> | 2015-10-02 11:34:13 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2015-10-02 11:34:13 +0200 |
| commit | 676599b36a92f3c201c5682ee7a5caddd9f370a4 (patch) | |
| tree | 6860752c26ccab76ee9db5e60ff465d1edf25feb /nss/Makefile | |
| parent | b0f81637d5bda47be93bac34b68f429a12979321 (diff) | |
| download | glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.tar.gz glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.tar.xz glibc-676599b36a92f3c201c5682ee7a5caddd9f370a4.zip | |
Harden putpwent, putgrent, putspent, putspent against injection [BZ #18724]
This prevents injection of ':' and '\n' into output functions which use the NSS files database syntax. Critical fields (user/group names and file system paths) are checked strictly. For backwards compatibility, the GECOS field is rewritten instead. The getent program is adjusted to use the put*ent functions in libc, instead of local copies. This changes the behavior of getent if user names start with '-' or '+'.
Diffstat (limited to 'nss/Makefile')
| -rw-r--r-- | nss/Makefile | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/nss/Makefile b/nss/Makefile index 02a50160cb..bbbad85d7e 100644 --- a/nss/Makefile +++ b/nss/Makefile @@ -26,6 +26,7 @@ headers := nss.h # This is the trivial part which goes into libc itself. routines = nsswitch getnssent getnssent_r digits_dots \ + valid_field valid_list_field rewrite_field \ $(addsuffix -lookup,$(databases)) # These are the databases that go through nss dispatch. @@ -47,8 +48,10 @@ install-bin := getent makedb makedb-modules = xmalloc hash-string extra-objs += $(makedb-modules:=.o) +tests-static = tst-field tests = test-netdb tst-nss-test1 test-digits-dots \ - tst-nss-getpwent bug17079 + tst-nss-getpwent bug17079 \ + $(tests-static) xtests = bug-erange # Specify rules for the nss_* modules. We have some services. @@ -83,8 +86,7 @@ libnss_db-inhibit-o = $(filter-out .os,$(object-suffixes)) ifeq ($(build-static-nss),yes) routines += $(libnss_files-routines) static-only-routines += $(libnss_files-routines) -tests-static = tst-nss-static -tests += $(tests-static) +tests-static += tst-nss-static endif include ../Rules |