RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 14:47:44 +00:00
Code Issues Activity Actions

Kernel+LibC: Enforce a limit on the number of supplementary group IDs

Browse source 
This patch adds the NGROUPS_MAX constant and enforces it in
sys$setgroups() to ensure that no process has more than 32 supplementary
group IDs.

The number doesn't mean anything in particular, just had to pick a
number. Perhaps one day we'll have a reason to change it.
This commit is contained in:
Andreas Kling 2022-08-20 22:22:58 +02:00
parent 998c1152ef
commit 9eeee24a39
3 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Kernel/API/POSIX/sys/limits.h Normal file
View file

@ -0,0 +1,9 @@
/*
* Copyright (c) 2022, Andreas Kling <kling@serenityos.org>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#pragma once
#define NGROUPS_MAX 32

4
Kernel/Syscalls/setuid.cpp
View file

@ -4,6 +4,7 @@
* SPDX-License-Identifier: BSD-2-Clause * SPDX-License-Identifier: BSD-2-Clause
*/ */
#include <Kernel/API/POSIX/sys/limits.h>
#include <Kernel/Process.h> #include <Kernel/Process.h>
namespace Kernel { namespace Kernel {
@ -246,6 +247,9 @@ ErrorOr<FlatPtr> Process::sys$setgroups(size_t count, Userspace<GroupID const*>
VERIFY_NO_PROCESS_BIG_LOCK(this); VERIFY_NO_PROCESS_BIG_LOCK(this);
TRY(require_promise(Pledge::id)); TRY(require_promise(Pledge::id));
if (count > NGROUPS_MAX)
return EINVAL;
auto credentials = this->credentials(); auto credentials = this->credentials();
if (!credentials->is_superuser()) if (!credentials->is_superuser())

3
Userland/Libraries/LibC/limits.h
View file

@ -1,11 +1,12 @@
/* /*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org> * Copyright (c) 2018-2022, Andreas Kling <kling@serenityos.org>
* *
* SPDX-License-Identifier: BSD-2-Clause * SPDX-License-Identifier: BSD-2-Clause
*/ */
#pragma once #pragma once
#include <Kernel/API/POSIX/sys/limits.h>
#include <bits/stdint.h> #include <bits/stdint.h>
#include <bits/wchar.h> #include <bits/wchar.h>