Bug 30992 – libsandbox doesn't check the old path while renaming

• Status: RESOLVED FIXED
• Product: Portage Development

[Description Andrea Luzzardi 2003-10-12 14:39:07 UTC]

sandbox's rename checks only the newpath while renaming.
This mean that a sandbox'ed process can move every file/directory they want from the system to a sandbox'ed write path. e.g.:
"rm /etc/passwd" inside the sandbox will not work, but something like:
"mv /etc/passwd . && rm passwd" will (assuming the current directory is in SANDBOX_WRITE).

I've made a small patch which checks the oldpath. Seems to work here, but i don't know if it'll break some packages.

[Comment 1 Andrea Luzzardi 2003-10-12 14:40:58 UTC]

Created attachment 19147 [details, diff]
libsandbox.c patch to make sandbox check the oldpath

[Comment 2 Martin Schlemmer (RETIRED) 2003-10-13 12:46:26 UTC]

Fixed in CVS.  Nick, I guess we can mark this as an possible security exploit,
although that is not really what sandbox is used for ?  Anyhow, could you
push for next portage revision ? thanks.

[Comment 3 Nicholas Jones (RETIRED) 2003-10-26 20:27:29 UTC]

Out in -r15