Fix for vfsload(3):

- Don't allow non-root users to specify LKMDIR.
- Don't allow any users to specify TMPDIR.
- Call /sbin/modload using execl() rather than execlp().

1 files changed, 7 insertions, 7 deletions

diff --git a/lib/libc/gen/getvfsent.c b/lib/libc/gen/getvfsent.c
index 05b50f8..d27bfee 100644
--- a/lib/libc/gen/getvfsent.c
+++ b/lib/libc/gen/getvfsent.c
@@ -17,6 +17,8 @@
 #include <errno.h>
 #include <paths.h>
 
+#define _PATH_MODLOAD	"/sbin/modload"	/* XXX should be in header file */
+
 static struct vfsconf *_vfslist = 0;
 static struct vfsconf _vfsconf;
 static size_t _vfslistlen = 0;
@@ -171,7 +173,7 @@ vfspath(const char *name)
 	char *userdir = getenv("LKMDIR");
 	int i;
 
-	if(userdir) {
+	if(userdir && getuid() == geteuid() && getuid() == 0) {
 		vfs_lkmdirs[NLKMDIRS - 2] = userdir;
 	}
 
@@ -226,9 +228,7 @@ vfsload(const char *name)
 	}
 
 	status = -1;
-	if(getenv("TMPDIR")) {
-		status = chdir(getenv("TMPDIR"));
-	}
+	unsetenv("TMPDIR");
 	if(status) {
 		status = chdir(_PATH_VARTMP);
 	}
@@ -236,12 +236,12 @@ vfsload(const char *name)
 		status = chdir(_PATH_TMP);
 	}
 	if(status) {
-		exit(status ? errno : 0);
+		exit(errno);
 	}
 
 	snprintf(name_mod, sizeof name_mod, "%s%s", name, "_mod");
-	status = execlp("modload", "modload", "-e", name_mod, "-o", name_mod,
-			"-u", "-q", path, (const char *)0);
+	status = execl(_PATH_MODLOAD, "modload", "-e", name_mod, "-o",
+		       name_mod, "-u", "-q", path, (const char *)0);
 
 	exit(status ? errno : 0);
 }