--- /tmp/policyd-weight-0.1.14-beta.orig/debian/policyd-weight/usr/sbin/policyd-weight 2008-03-28 10:34:26.000000000 +0100+++ /tmp/policyd-weight-0.1.14-beta/debian/policyd-weight/usr/sbin/policyd-weight 2008-03-28 15:49:41.922551492 +0100@@ -247,6 +247,7 @@ } use Fcntl;+use File::Spec; use Sys::Syslog qw(:DEFAULT setlogsock); use Net::DNS; use Net::DNS::Packet qw(dn_expand);@@ -592,6 +593,12 @@ $conf_str = "";+#+# check for nasty symlinks+#+check_symlnk('main: init:',+ $LOCKPATH, $PIDFILE, $SPATH, "$LOCKPATH/cache_lock");+ # send HUP to kids if $RELOAD if($RELOAD) {@@ -2346,12 +2353,12 @@ } create_lockpath('cache');- # grey magic to avoid races at startups+ # avoid races at startups mkdir $LOCKPATH.'/cache_lock' or return undef; # check if a cache-socket file exist, and # whether we can connect to it.- if( -f $SPATH)+ if( -S $SPATH) { my $test_sock = IO::Socket::UNIX->new($SPATH); return undef if ($test_sock && $test_sock->connected);@@ -2841,6 +2848,11 @@ mkdir $LOCKPATH or die "$who: error while creating $LOCKPATH: $!"; }+ #+ # check LOCKPATH, SPATH and cache_lock for being part of symlinks+ #+ check_symlnk( $who, $LOCKPATH, $SPATH, "$LOCKPATH/cache_lock" );+ my $tuid = $USER; if($USER =~ /[^0-9]/)@@ -2860,6 +2872,56 @@ } }+#+# usage: check_symlnk($caller, @files)+#+# caller: context specifier (eg: "cache: function:")+# files: list of files to check+sub check_symlnk+{+ my $who = shift;+ for ( @_ )+ {+ my $file = File::Spec->canonpath($_);++ my @stat = lstat( $file );++ if(! -e _)+ {+ next;+ }++ # first, file must not be a symlink+ if ( -l _ )+ {+ fatal_exit("$who: $file is a symbolic link. Symbolic links are not expected and not allowed within policyd-weight. Exiting!");+ }++ # second, file must be owned by uid root or $USER and+ # gid root/wheel or $USER+ if(!(+ (+ $stat[4] == getpwnam($USER) ||+ $stat[4] == "0"+ ) &&+ (+ $stat[5] == getgrnam($GROUP) ||+ $stat[5] == "0"+ )+ )+ )+ {+ fatal_exit("$who: $file is owned by UID $stat[4], GID $stat[5]. Exiting!");+ }++ # second the file/dir must not be world writeable+ if(sprintf("%04o",$stat[2]) =~ /(7|6|3|2)$/)+ {+ fatal_exit("$who: $file is world writeable. Exiting!");+ }+ }+}+ # function for sanitizing floating point output sub myrnd {