Check primary group memberships as well as supplementary group

memberships, and only allow group-writability by groups with exactly one
member, as zero-member groups are typically used by setgid binaries
rather than being user-private groups (closes: #581697).

1 files changed, 32 insertions, 7 deletions

diff --git a/misc.c b/misc.c
index 4ca318423..f9da621d6 100644
--- a/misc.c
+++ b/misc.c
@@ -643,22 +643,47 @@ secure_permissions(struct stat *st, uid_t uid)
 {
         if (st->st_uid != 0 && st->st_uid != uid)
                 return 0;
+        if ((st->st_mode & 002) != 0)
+                return 0;
         if ((st->st_mode & 020) != 0) {
                 /* If the file is group-writable, the group in question must
-                 * have at most one member, namely the file's owner.
+                 * have exactly one member, namely the file's owner.
+                 * (Zero-member groups are typically used by setgid
+                 * binaries, and are unlikely to be suitable.)
                  */
-                struct passwd *pw = getpwuid(st->st_uid);
-                struct group *gr = getgrgid(st->st_gid);
-                if (!pw || !gr)
+                struct passwd *pw;
+                struct group *gr;
+                int members = 0;
+
+                gr = getgrgid(st->st_gid);
+                if (!gr)
                         return 0;
-                else if (gr->gr_mem[0]) {
+
+                /* Check primary group memberships. */
+                while ((pw = getpwent()) != NULL) {
+                        if (pw->pw_gid == gr->gr_gid) {
+                                ++members;
+                                if (pw->pw_uid != uid)
+                                        return 0;
+                        }
+                }
+                endpwent();
+
+                pw = getpwuid(st->st_uid);
+                if (!pw)
+                        return 0;
+
+                /* Check supplementary group memberships. */
+                if (gr->gr_mem[0]) {
+                        ++members;
                         if (strcmp(pw->pw_name, gr->gr_mem[0]) ||
                             gr->gr_mem[1])
                                 return 0;
                 }
+
+                if (!members)
+                        return 0;
         }
-        if ((st->st_mode & 002) != 0)
-                return 0;
         return 1;
 }