diff options
| author | Daniil Baturin <daniil@baturin.org> | 2026-02-23 19:48:12 +0000 |
|---|---|---|
| committer | Daniil Baturin <daniil@baturin.org> | 2026-02-23 19:48:12 +0000 |
| commit | ffde10a863f4da905618139ad1ab03dcf613cfa2 (patch) | |
| tree | df0ee25abff7fe2d5dc615db18ed06d986561d90 /src | |
| parent | e70df7b80c3d80a33def819408a2fd4d4823d119 (diff) | |
| download | vyos-1x-ffde10a863f4da905618139ad1ab03dcf613cfa2.tar.gz vyos-1x-ffde10a863f4da905618139ad1ab03dcf613cfa2.zip | |
vyos-op-run: T8301: improve the security of UID check and setuid logic
Diffstat (limited to 'src')
| -rw-r--r-- | src/vyos_op_run.ml | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/vyos_op_run.ml b/src/vyos_op_run.ml index 6299a1d9c..7afa07111 100644 --- a/src/vyos_op_run.ml +++ b/src/vyos_op_run.ml @@ -218,7 +218,7 @@ let group_perms_match perms group cmd = let is_admin () = (* If executed by root, skip all permission checks *) - if Unix.geteuid () = 0 then true else + if Unix.getuid () = 0 then true else (* Otherwise, check if the user is a VyOS admin *) let admin_group = Unix.getgrnam vyos_admin_group_name in let user_groups = Unix.getgroups () in @@ -487,10 +487,10 @@ let () = let () = setup_logging debug in let op_defs = read_command_definitions () in let permissions = read_permissions () in - let () = Unix.setuid 0 in let () = Logs.debug @@ fun m -> m "Executing VyOS command [%s]" (String.concat " " args) in try check_command_permissions permissions args; + Unix.setuid 0; run_vyos_command options ~env:[] ~parent:"" op_defs args with | Permission_error -> |