increased security: added option "web files group", so that netdata will also check the group of the files it sends over the web - checks on the user were already in place #186
Costa Tsaousis (ktsaou) committed
Apr 7, 2016 at 17:42 UTC
8bb28f2f6a6526847fc3d2bc8a216e041a0f8677
1 file changed
+33
src/web_client.c
+33
@@ -14,6 +14,7 @@
14
#include <netinet/tcp.h>
15
#include <malloc.h>
16
#include <pwd.h>
17
+#include <grp.h>
18
#include <ctype.h>
19
20
#include "common.h"
@@ -250,6 +251,31 @@ uid_t web_files_uid(void)
251
return(owner_uid);
252
}
253
254
+gid_t web_files_gid(void)
255
+{
256
+ static char *web_group = NULL;
257
+ static gid_t owner_gid = 0;
258
+
259
+ if(unlikely(!web_group)) {
260
+ web_group = config_get("global", "web files group", config_get("global", "web files owner", NETDATA_USER));
261
+ if(!web_group || !*web_group)
262
+ owner_gid = getegid();
263
+ else {
264
+ struct group *gr = getgrnam(web_group);
265
+ if(!gr) {
266
+ error("Group %s is not present. Ignoring option.", web_group);
267
+ owner_gid = getegid();
268
+ }
269
+ else {
270
+ debug(D_WEB_CLIENT, "Web files group set to %s.\n", web_group);
271
+ owner_gid = gr->gr_gid;
272
+ }
273
+ }
274
+ }
275
+
276
+ return(owner_gid);
277
+}
278
+
279
int mysendfile(struct web_client *w, char *filename)
280
{
281
static char *web_dir = NULL;
@@ -300,6 +326,13 @@ int mysendfile(struct web_client *w, char *filename)
326
return 403;
327
}
328
329
+ // check if the file is owned by expected group
330
+ if(stat.st_gid != web_files_gid()) {
331
+ error("%llu: File '%s' is owned by group %d (expected group %d). Access Denied.", w->id, webfilename, stat.st_gid, web_files_gid());
332
+ buffer_sprintf(w->response.data, "Access to file '%s' is not permitted.", webfilename);
333
+ return 403;
334
+ }
335
+
336
if((stat.st_mode & S_IFMT) == S_IFDIR) {
337
snprintf(webfilename, FILENAME_MAX+1, "%s/index.html", filename);
338
return mysendfile(w, webfilename);