sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-18 20:49:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reject empty approval request_id and verify gid after setgid

Browse Source
This commit is contained in:
Viktor Liu
2026-07-13 11:52:50 +02:00
parent 125250c5df
commit eb6e8dc905
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
client/cmd/vnc_agent_dropprivs_darwin.go
View File

@@ -49,6 +49,9 @@ func dropAgentPrivileges(targetUID uint32) error {
if err := syscall.Setgid(targetGID); err != nil {
return fmt.Errorf("setgid(%d): %w", targetGID, err)
}
if os.Getgid() != targetGID || os.Getegid() != targetGID {
return fmt.Errorf("setgid verification: gid=%d egid=%d, expected %d", os.Getgid(), os.Getegid(), targetGID)
}
if err := syscall.Setuid(int(targetUID)); err != nil {
return fmt.Errorf("setuid(%d): %w", targetUID, err)
}

3
client/server/server.go
View File

@@ -1906,6 +1906,9 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
// request_ids are silently no-op'd so a slow UI cannot deny a prompt the
// user already handled (or that already timed out).
func (s *Server) RespondApproval(_ context.Context, msg *proto.RespondApprovalRequest) (*proto.RespondApprovalResponse, error) {
if msg.GetRequestId() == "" {
return nil, gstatus.Errorf(codes.InvalidArgument, "request_id is required")
}
s.mutex.Lock()
connectClient := s.connectClient
s.mutex.Unlock()