cupsdGetPrivateAttrs: @ACL never grants access, and @OWNER is looked up as an operating-system group for non-owners

Abierto
  • ¿Algo no está bien?
#1,796 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
c
Área
authorization, security

Línea de trabajo

Start in scheduler/policy.c, in cupsdGetPrivateAttrs() between lines 352 and 440. The @ACL branch (354-383) needs a matched user to return NULL, and the @OWNER handling (384-393) must stop reserved tokens from reaching the generic '@' group lookup at 409. Done means a listed ACL user is denied, a non-owner never gets group-based access through a group named OWNER, and the final return at 439 is reached only when no entry matches. This is a security-sensitive authorization change, so check with maintainers before writing a patch.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary
cupsdGetPrivateAttrs() decides whether the requester may see a job's private attributes by walking the access list and returning NULL as soon as one entry accepts them. The @ACL entry does not do that: when the inner loop finds the requester, it breaks out of the loop and then falls through to the end of the function, so the function returns the private-attribute list instead of NULL and the requester is filtered. In the other direction, @OWNER has a branch only when the requester is the owner; every other requester falls into the generic name[0] == '@' case at line 409, where the token is treated as the name of an operating-system group, so membership of a group literally named OWNER is accepted as ownership.

Affected code: scheduler/policy.c:352–440, specifically 354–383 (@ACL), 384–393 (@OWNER), 409–420 (generic @ fallback) and 439 (final return). Unchanged in current master 3949d140567cf7b6cede1ea48e4ca6db92066c91.

Reachable sequence, @ACL

  1. A printer is configured so that access requires membership of an ACL, and a policy or operation uses that printer's access list to decide visibility of private attributes — for example the default JobPrivateAccess handling.
  2. A user who is listed in the printer's ACL submits a request that reaches cupsdGetPrivateAttrs() with @ACL among the entries.
  3. Lines 358–382 walk the list and find the user, breaking at 369, 378 or 381 depending on the entry form.
  4. Nothing is returned. Control leaves the if block at 383, the outer loop at 352 moves to the next entry, and if no other entry matches, line 439 returns the private-attribute list.
  5. The caller therefore treats an explicitly authorised user as having no access. The ACL has no observable effect.

By contrast, the @SYSTEM branch at 394–408 returns NULL from inside its loop, which is the behaviour @ACL was clearly meant to have.

Reachable sequence, @OWNER

  1. An access list contains @OWNER, which is the shipped default for JobPrivateAccess.
  2. A user who is not the job owner requests the attributes. The condition at 384–385 requires the requester to equal owner, so it fails.
  3. Line 409 matches because the token starts with @, and line 411 calls cupsdCheckGroup(username, pw, "OWNER").
  4. If the host has an operating-system group named OWNER and the requester belongs to it, the group check succeeds, line 418 returns NULL, and the requester is treated as having direct access to the job's private attributes.

The second case is narrow — it requires a group with that exact name to exist — but it is fail-open, whereas the first is fail-closed. Both stem from reserved tokens being allowed to reach the generic group branch.

This report is about a requester who already has a valid authenticated identity and a way to reach the resource; it is not about an anonymous client.

Suggested fix
Make the reserved tokens terminate the walk. A matched @ACL should return NULL; an unmatched one should skip to the next entry rather than fall through to the group lookup. @OWNER should be recognised as reserved regardless of who the requester is, so a non-owner never reaches the group branch.

    if (printer && !_cups_strcasecmp(name, "@ACL"))
    {
      int	matched = 0;

      for (acl = (char *)cupsArrayFirst(printer->users);
	   acl;
	   acl = (char *)cupsArrayNext(printer->users))
	if (/* existing checks */)
	{
	  matched = 1;
	  break;
	}

      if (matched)
	return (NULL);
      else
	continue;			/* do not fall through to the generic '@' case */
    }

and treat @OWNER / @ACL / @SYSTEM as reserved in the condition at 409, so a token that names a reserved keyword is never resolved as an OS group.

Lenguaje dominante
C
Estrellas
1.8k
Forks
353
Merge medio
19 h 41 min
PR fusionados (30 d)
18

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenPrinting/cups

Todos los issues de OpenPrinting/cups

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.