From 0966d7fd6e3d51fc99088de94343212c5f09e74d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miroslav=20Such=C3=BD?= <msuchy@redhat.com>
Date: Tue, 5 May 2020 18:28:50 +0200
Subject: [PATCH] setgid instead of setuid the
 abrt-action-install-debuginfo-to-abrt-cache [RHBZ 1796245]

OpenSCAP does not like setuid files, we can be setgid instead.

We need to g+w the directories so other run under a different user can be able to write there too.

Resolves:
    https://bugzilla.redhat.com/show_bug.cgi?id=1796245
---
 abrt.spec.in                                      |  4 ++--
 .../abrt-action-install-debuginfo-to-abrt-cache.c | 15 +++------------
 src/plugins/abrt-action-install-debuginfo.in      |  6 ++++++
 3 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/abrt.spec.in b/abrt.spec.in
index 326294008..4c01fffe6 100644
--- a/abrt.spec.in
+++ b/abrt.spec.in
@@ -1015,8 +1015,8 @@ killall abrt-dbus >/dev/null 2>&1 || :
 
 %dir %{_localstatedir}/lib/abrt
 
-# attr(6755) ~= SETUID|SETGID
-%attr(6755, abrt, abrt) %{_libexecdir}/abrt-action-install-debuginfo-to-abrt-cache
+# attr(2755) ~= SETGID
+%attr(2755, abrt, abrt) %{_libexecdir}/abrt-action-install-debuginfo-to-abrt-cache
 
 %{_bindir}/abrt-action-analyze-c
 %{_bindir}/abrt-action-trim-files
diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
index 71967f77a..0f843512e 100644
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
@@ -78,7 +78,6 @@ int main(int argc, char **argv)
     const gid_t egid = getegid();
     const gid_t rgid = getgid();
     const uid_t euid = geteuid();
-    const gid_t ruid = getuid();
 
     /* We need to open the build ids file under the caller's UID/GID to avoid
      * information disclosures when reading files with changed UID.
@@ -93,17 +92,11 @@ int main(int argc, char **argv)
         if (setregid(egid, rgid) < 0)
             perror_msg_and_die("setregid(egid, rgid)");
 
-        if (setreuid(euid, ruid) < 0)
-            perror_msg_and_die("setreuid(euid, ruid)");
-
         const int build_ids_fd = open(build_ids, O_RDONLY);
 
         if (setregid(rgid, egid) < 0)
             perror_msg_and_die("setregid(rgid, egid)");
 
-        if (setreuid(ruid, euid) < 0 )
-            perror_msg_and_die("setreuid(ruid, euid)");
-
         if (build_ids_fd < 0)
             perror_msg_and_die("Failed to open file '%s'", build_ids);
 
@@ -155,12 +148,10 @@ int main(int argc, char **argv)
      */
     /* do setregid only if we have to, to not upset selinux needlessly */
     if (egid != rgid)
-        IGNORE_RESULT(setregid(egid, egid));
-    if (euid != ruid)
     {
-        IGNORE_RESULT(setreuid(euid, euid));
-        /* We are suid'ed! */
-        /* Prevent malicious user from messing up with suid'ed process: */
+        IGNORE_RESULT(setregid(egid, egid));
+        /* We are sgid'ed! */
+        /* Prevent malicious user from messing up with sgid'ed process: */
 #if 1
 // We forgot to sanitize PYTHONPATH. And who knows what else we forgot
 // (especially considering *future* new variables of this kind).
diff --git a/src/plugins/abrt-action-install-debuginfo.in b/src/plugins/abrt-action-install-debuginfo.in
index 6269c221e..659a9aa84 100644
--- a/src/plugins/abrt-action-install-debuginfo.in
+++ b/src/plugins/abrt-action-install-debuginfo.in
@@ -248,6 +248,12 @@ if __name__ == "__main__":
                                     repo_pattern=repo_pattern,
                                     releasever=releasever)
             result = downloader.download(missing, download_exact_files=exact_fls)
+
+            # make sure that all downloaded directories are writeable by abrt group
+            for root, dirs, files in os.walk(self.cachedirs[0]):
+                for walked_dir in dirs:
+                    os.chmod(os.path.join(root, walked_dir), 0o775)
+
         except OSError as ex:
             if ex.errno == errno.EPIPE:
                 clean_up(TMPDIR, silent=True)
-- 
2.21.3