[at-spi2-atk] Always accept connections as root if unable to find an owning user



commit 97f163edd95e46be9aa5d8315fbbed75fa5d8323
Author: Mike Gorse <mgorse suse com>
Date:   Mon Dec 7 11:53:49 2015 -0600

    Always accept connections as root if unable to find an owning user
    
    When running as root, we look through /proc to try to identify our
    parent and check that it matches the user making a connection. However,
    this check does not always yield useful information and also will
    always fail on anything that isn't Linux. Unsure what security
    implications this change has, but then it isn't ideal to run UI as
    the super-user in the first place, yet users sometimes need to do so
    for various reasons, and a11y needs to be enabled, so adding this
    change unless a better solution is found.

 atk-adaptor/bridge.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)
---
diff --git a/atk-adaptor/bridge.c b/atk-adaptor/bridge.c
index 9c2117f..d0ca5da 100644
--- a/atk-adaptor/bridge.c
+++ b/atk-adaptor/bridge.c
@@ -661,7 +661,10 @@ user_check (DBusConnection *bus, unsigned long uid, void *data)
   if (uid == getuid () || uid == geteuid ())
     return TRUE;
   if (getuid () == 0)
-    return get_ancestral_uid (getpid ()) == uid;
+  {
+    guint ancestor = get_ancestral_uid (getpid ());
+    return (ancestor == uid || ancestor == 1 || ancestor == 0);
+  }
   return FALSE;
 }
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]