From eb6e8dc9056650d77c80d8444803deb507885162 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Mon, 13 Jul 2026 11:52:50 +0200 Subject: [PATCH] Reject empty approval request_id and verify gid after setgid --- client/cmd/vnc_agent_dropprivs_darwin.go | 3 +++ client/server/server.go | 3 +++ 2 files changed, 6 insertions(+) diff --git a/client/cmd/vnc_agent_dropprivs_darwin.go b/client/cmd/vnc_agent_dropprivs_darwin.go index d61e33747..ae8cc0281 100644 --- a/client/cmd/vnc_agent_dropprivs_darwin.go +++ b/client/cmd/vnc_agent_dropprivs_darwin.go @@ -49,6 +49,9 @@ func dropAgentPrivileges(targetUID uint32) error { if err := syscall.Setgid(targetGID); err != nil { return fmt.Errorf("setgid(%d): %w", targetGID, err) } + if os.Getgid() != targetGID || os.Getegid() != targetGID { + return fmt.Errorf("setgid verification: gid=%d egid=%d, expected %d", os.Getgid(), os.Getegid(), targetGID) + } if err := syscall.Setuid(int(targetUID)); err != nil { return fmt.Errorf("setuid(%d): %w", targetUID, err) } diff --git a/client/server/server.go b/client/server/server.go index a3ff1e2ef..7cc9bbd7d 100644 --- a/client/server/server.go +++ b/client/server/server.go @@ -1906,6 +1906,9 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon // request_ids are silently no-op'd so a slow UI cannot deny a prompt the // user already handled (or that already timed out). func (s *Server) RespondApproval(_ context.Context, msg *proto.RespondApprovalRequest) (*proto.RespondApprovalResponse, error) { + if msg.GetRequestId() == "" { + return nil, gstatus.Errorf(codes.InvalidArgument, "request_id is required") + } s.mutex.Lock() connectClient := s.connectClient s.mutex.Unlock()