3 Commits

Author	SHA1	Message	Date
Todd C. Miller	fffcc07c53	Revert pivot_root and go back to prepending the new root directory. ... We cannot perform passwd/group lookups _after_ changing the root directory. This does mean that symbolic links in a path are not currently handled properly when matching chroot()ed commands. Fixes a local privilege escalation vulnerability where a user could craft their own nsswitch.conf file to load a shared library of their choosing and run arbitrary code. CVE-2025-32463 Reported by Rich Mirch @ Stratascale Cyber Research Unit (CRU).	2025-06-28 10:32:09 -06:00
Todd C. Miller	e343e07543	Use #include <foo.h> instead of #include "foo.h" in most cases. ... We rely on the include path to find many of these headers. It especially doesn't make sense to use #include "foo.h" for headers in the top-level include directory.	2023-09-25 10:13:28 -06:00
Todd C. Miller	6e75f2311d	Add resolve_cmnd(), a wrapper around find_path(). ... This is a convenience function that sets PERM_RUNAS and calls find_path(). If the command is not found it will retry with PERM_USER instead.	2023-09-18 12:42:51 -06:00