From 3e190ca8c72b341083ee08ab71ba0f505a3d6b57 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 10 Aug 2020 17:42:57 +0200
Subject: [PATCH 1/2] PROXY: child process security hardening

Resolves: https://github.com/SSSD/sssd/issues/3730
---
 src/providers/proxy/proxy_child.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/providers/proxy/proxy_child.c b/src/providers/proxy/proxy_child.c
index bb96ec0f4a..dfeab68e41 100644
--- a/src/providers/proxy/proxy_child.c
+++ b/src/providers/proxy/proxy_child.c
@@ -499,6 +499,20 @@ int main(int argc, const char *argv[])
     /* Set debug level to invalid value so we can decide if -d 0 was used. */
     debug_level = SSSDBG_INVALID;
 
+    ret = chdir("/");
+    if (ret != 0) {
+        fprintf(stderr, "\nFailed to chdir()\n\n");
+        return 1;
+    }
+
+    ret = clearenv();
+    if (ret != 0) {
+        fprintf(stderr, "\nFailed to clear env.\n\n");
+        return 1;
+    }
+
+    umask(SSS_DFL_UMASK);
+
     pc = poptGetContext(argv[0], argc, argv, long_options, 0);
     while((opt = poptGetNextOpt(pc)) != -1) {
         switch(opt) {
@@ -546,12 +560,6 @@ int main(int argc, const char *argv[])
         return 2;
     }
 
-    ret = unsetenv("_SSS_LOOPS");
-    if (ret != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to unset _SSS_LOOPS, "
-                  "pam modules might not work as expected.\n");
-    }
-
     ret = confdb_get_string(main_ctx->confdb_ctx, main_ctx, conf_entry,
                             CONFDB_PROXY_PAM_TARGET, NULL, &pam_target);
     if (ret != EOK) {

From 254dbbbbfdffe66836e8e203cd56113246d45fe5 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 22 Jan 2021 15:54:50 +0100
Subject: [PATCH 2/2] PROXY: sanitize --domain option to allow safe usage as a
 part of log file name

Resolves: https://github.com/SSSD/sssd/issues/3730
---
 src/providers/proxy/proxy_child.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/providers/proxy/proxy_child.c b/src/providers/proxy/proxy_child.c
index dfeab68e41..bb689e539f 100644
--- a/src/providers/proxy/proxy_child.c
+++ b/src/providers/proxy/proxy_child.c
@@ -530,6 +530,10 @@ int main(int argc, const char *argv[])
             poptPrintUsage(pc, stderr, 0);
             return 1;
     }
+    if (strchr(domain, '/') != NULL) {
+        fprintf(stderr, "\nForbidden symbol '/' in the --domain option.\n\n");
+        return 1;
+    }
 
     if (id == 0) {
         fprintf(stderr, "\nMissing option, "
