From fe37fc6d006b47f840b7b78cc9a8a0633f74f9e3 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 10 Aug 2020 17:42:57 +0200
Subject: [PATCH 1/3] PROXY: child process security hardening

Resolves:
https://github.com/SSSD/sssd/issues/3730
---
 src/providers/proxy/proxy_child.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/providers/proxy/proxy_child.c b/src/providers/proxy/proxy_child.c
index dc06f4669d..f4c4766f29 100644
--- a/src/providers/proxy/proxy_child.c
+++ b/src/providers/proxy/proxy_child.c
@@ -499,6 +499,10 @@ int main(int argc, const char *argv[])
     /* Set debug level to invalid value so we can decide if -d 0 was used. */
     debug_level = SSSDBG_INVALID;
 
+    chdir("/");
+    clearenv();
+    umask(SSS_DFL_UMASK);
+
     pc = poptGetContext(argv[0], argc, argv, long_options, 0);
     while((opt = poptGetNextOpt(pc)) != -1) {
         switch(opt) {

From 28cf9a869523dc295b6fcd5dc48e9a2f0cdea921 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 10 Aug 2020 19:26:43 +0200
Subject: [PATCH 2/3] UTIL: added helper to facilitate domain name validation

Relates:
https://github.com/SSSD/sssd/issues/3730
---
 src/util/util.c | 30 ++++++++++++++++++++++++++++++
 src/util/util.h |  3 +++
 2 files changed, 33 insertions(+)

diff --git a/src/util/util.c b/src/util/util.c
index 19d4473287..5f2431fc9f 100644
--- a/src/util/util.c
+++ b/src/util/util.c
@@ -971,6 +971,36 @@ bool is_user_or_group_name(const char *sudo_user_value)
     return true;
 }
 
+bool is_syntactically_correct_domain_name(const char *domain)
+{
+    size_t i;
+    char c;
+
+    if ((domain == NULL) || (domain[0] == 0)) {
+        return false;
+    }
+
+    /* Per man page:
+     * ```
+     * A domain name should only consist of alphanumeric ASCII characters,
+     * dashes, dots and underscores.
+     * ```
+     */
+    for (i = 0; i < strlen(domain); ++i) {
+        c = domain[i];
+        if (!( ((c >= '0') && (c <= '9')) ||
+               ((c >= 'A') && (c <= 'Z')) ||
+               ((c >= 'a') && (c <= 'z')) ||
+               (c == '-') ||
+               (c == '.') ||
+               (c == '_') )) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 bool is_socket_activated(void)
 {
 #ifdef HAVE_SYSTEMD
diff --git a/src/util/util.h b/src/util/util.h
index d538e0674d..0527e8d7c2 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -401,6 +401,9 @@ errno_t sss_hash_create_ex(TALLOC_CTX *mem_ctx,
 /* Returns true if sudoUser value is a username or a groupname */
 bool is_user_or_group_name(const char *sudo_user_value);
 
+/* Returns true if `domain` is syntactically correct domain name */
+bool is_syntactically_correct_domain_name(const char *domain);
+
 /* Returns true if the responder has been socket-activated */
 bool is_socket_activated(void);
 

From 2b3664498b3f6ea70d7563de8587209e618f7ab0 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Mon, 10 Aug 2020 19:36:57 +0200
Subject: [PATCH 3/3] Data provider & proxy child: validation of "--domain"
 param

Resolves:
https://github.com/SSSD/sssd/issues/3730
---
 src/providers/data_provider_be.c  | 5 +++--
 src/providers/proxy/proxy_child.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
index 95665332a7..0330d3ec25 100644
--- a/src/providers/data_provider_be.c
+++ b/src/providers/data_provider_be.c
@@ -689,8 +689,9 @@ int main(int argc, const char *argv[])
         }
     }
 
-    if (be_domain == NULL) {
-        fprintf(stderr, "\nMissing option, --domain is a mandatory option.\n\n");
+    if (!is_syntactically_correct_domain_name(be_domain)) {
+        fprintf(stderr, "\nMissing or malfromed option, "
+                        "--domain is a mandatory option.\n\n");
             poptPrintUsage(pc, stderr, 0);
             return 1;
     }
diff --git a/src/providers/proxy/proxy_child.c b/src/providers/proxy/proxy_child.c
index f4c4766f29..8a0c612627 100644
--- a/src/providers/proxy/proxy_child.c
+++ b/src/providers/proxy/proxy_child.c
@@ -514,8 +514,8 @@ int main(int argc, const char *argv[])
         }
     }
 
-    if (domain == NULL) {
-        fprintf(stderr, "\nMissing option, "
+    if (!is_syntactically_correct_domain_name(domain)) {
+        fprintf(stderr, "\nMissing or malformed option, "
                         "--domain is a mandatory option.\n\n");
             poptPrintUsage(pc, stderr, 0);
             return 1;
