diff options
| author | Simon McVittie <smcv@debian.org> | 2017-01-09 17:46:07 +0000 |
|---|---|---|
| committer | Atomic Bot <atomic-devel@projectatomic.io> | 2017-01-09 19:48:44 +0000 |
| commit | d7fc532c42f0e9bf427923bab85433282b3e5117 (patch) | |
| tree | ef292e9b060be51fd9e110df401196a53dff0363 | |
| parent | a10af855abdd444df5e464187c15e1c81fa18d4d (diff) | |
| download | bubblewrap-d7fc532c42f0e9bf427923bab85433282b3e5117.tar.gz | |
Call setsid() before executing sandboxed code (CVE-2017-5226)
This prevents the sandboxed code from getting a controlling tty,
which in turn prevents it from accessing the TIOCSTI ioctl and hence
faking terminal input.
Fixes: #142
Closes: #143
Approved by: cgwalters
| -rw-r--r-- | bubblewrap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/bubblewrap.c b/bubblewrap.c index 6e04459..4b5b8e6 100644 --- a/bubblewrap.c +++ b/bubblewrap.c @@ -2071,6 +2071,9 @@ main (int argc, /* We want sigchild in the child */ unblock_sigchild (); + if (setsid () == (pid_t) -1) + die_with_error ("setsid"); + if (label_exec (opt_exec_label) == -1) die_with_error ("label_exec %s", argv[0]); |