Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deny DYLD_* for any s{u,g}id binary, not just root. #9

Closed
wants to merge 1 commit into from
Closed

Deny DYLD_* for any s{u,g}id binary, not just root. #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions SUIDGuard/SUIDGuard.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ struct fileglob {
void *fg_vn_data; /* Per fd vnode data, used for directories */
};

/* purpose of this hook is to detect execution of SUID/SGID root binaries and
/* purpose of this hook is to detect execution of SUID/SGID binaries and
when found it will scan the environment variables for this process in
kernel memory and overwrite all DYLD_ variables to protect against weaknesses
in the dyld code */
Expand Down Expand Up @@ -100,8 +100,8 @@ int suidguard_cred_label_update_execve(kauth_cred_t old_cred, kauth_cred_t new_c
goto exit;
}

/* now check if this is a SUID/SGID root binary */
if ((va.va_mode & (VSUID|VSGID)) && ((va.va_uid == 0) || (va.va_gid == 0))) {
/* now check if this is a SUID/SGID binary */
if (va.va_mode & (VSUID|VSGID)) {

int i;
int found = 0;
Expand All @@ -118,7 +118,7 @@ int suidguard_cred_label_update_execve(kauth_cred_t old_cred, kauth_cred_t new_c
tmp += strlen(tmp)+1;
}
if (found) {
printf("SUIDGuard: found and neutralized DYLD_ environment variable for SUID/SGID root binary\n");
printf("SUIDGuard: found and neutralized DYLD_ environment variable for SUID/SGID binary\n");
}
}

Expand Down