[Pkg-puppet-devel] [SCM] Puppet packaging for Debian branch, master, updated. puppet-0.24.5-rc3-1468-g701d060

[Nigel Kersten]

The following commit has been merged in the master branch:
commit 701d0609a840b1ac90d906bd454a1170c0efb8a0
Author: Nigel Kersten <nigelk at google.com>
Date:   Wed Dec 16 11:07:03 2009 -0800

    cherry pick upstream fix for supplementary groups not being reset. (CVE-2009-3564) (closes: #551073)

diff --git a/debian/changelog b/debian/changelog
index c91d115..c4fa217 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,10 @@
 puppet (0.25.1-3) unstable; urgency=low
 
   * cherry pick upstream fix for puppetrun with tags (closes: #559092)
+  * cherry pick upstream fix for supplementary groups not being reset.
+    (CVE-2009-3564) (closes: #551073)
 
- -- Nigel Kersten <nigel at explanatorygap.net>  Wed, 16 Dec 2009 10:53:39 -0800
+ -- Nigel Kersten <nigelk at google.com>  Wed, 16 Dec 2009 11:04:29 -0800
 
 puppet (0.25.1-2) unstable; urgency=low
 
diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index 6f83c7a..21573d1 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -55,10 +55,11 @@ module Util
             end
             unless Puppet::Util::SUIDManager.uid == user
                 begin
+                    Puppet::Util::SUIDManager.initgroups(user)
                     Puppet::Util::SUIDManager.uid = user
                     Puppet::Util::SUIDManager.euid = user
-                rescue
-                    $stderr.puts "could not change to user %s" % user
+                rescue => detail
+                    $stderr.puts "Could not change to user %s: %s" % [user, detail]
                     exit(74)
                 end
             end
diff --git a/lib/puppet/util/suidmanager.rb b/lib/puppet/util/suidmanager.rb
index c5df0d1..a0a9178 100644
--- a/lib/puppet/util/suidmanager.rb
+++ b/lib/puppet/util/suidmanager.rb
@@ -7,7 +7,7 @@ module Puppet::Util::SUIDManager
     extend Forwardable
 
     to_delegate_to_process = [ :euid=, :euid, :egid=, :egid,
-                               :uid=, :uid, :gid=, :gid ]
+                               :uid=, :uid, :gid=, :gid, :groups=, :groups ]
 
     to_delegate_to_process.each do |method|
         def_delegator Process, method
@@ -26,13 +26,16 @@ module Puppet::Util::SUIDManager
         # We set both because some programs like to drop privs, i.e. bash.
         old_uid, old_gid = self.uid, self.gid
         old_euid, old_egid = self.euid, self.egid
+        old_groups = self.groups
         begin
             self.egid = convert_xid :gid, new_gid if new_gid
+            self.initgroups(convert_xid(:uid, new_uid)) if new_uid
             self.euid = convert_xid :uid, new_uid if new_uid
 
             yield
         ensure
             self.euid, self.egid = old_euid, old_egid
+            self.groups = old_groups
         end
     end
     module_function :asuser
@@ -49,6 +52,13 @@ module Puppet::Util::SUIDManager
     end
     module_function :convert_xid
 
+    # Initialize supplementary groups
+    def initgroups(user)
+        require 'etc'
+        Process.initgroups(Etc.getpwuid(user).name, Process.gid)
+    end
+
+    module_function :initgroups
 
     def run_and_capture(command, new_uid=nil, new_gid=nil)
         output = Puppet::Util.execute(command, :failonfail => false, :uid => new_uid, :gid => new_gid)

-- 
Puppet packaging for Debian