update to upstream 2024-01-13 - #11
Draft
1000TurquoisePogs wants to merge 95 commits into
Draft
Conversation
…t{index} (initial patch by bnoordhuis)
…he 'return' statement
…ks (gihub ticket #166)
1000TurquoisePogs
marked this pull request as draft
May 14, 2025 13:02
1000TurquoisePogs
changed the title
Signed-off-by: Joe Devlin <joe.devlin@gmail.com>
Signed-off-by: Martin Zeithaml <Martin.Zeithaml@broadcom.com>
Signed-off-by: Martin Zeithaml <Martin.Zeithaml@broadcom.com>
Signed-off-by: Martin Zeithaml <Martin.Zeithaml@broadcom.com>
Update the instructions
Signed-off-by: Martin Zeithaml <Martin.Zeithaml@broadcom.com>
Signed-off-by: Martin Zeithaml <Martin.Zeithaml@broadcom.com>
Signed-off-by: Martin Zeithaml <Martin.Zeithaml@broadcom.com>
…ore uid
The child of os.exec(args, {uid, gid}) called setuid() before setgid(), so
the documented uid-plus-gid form always died: setuid() gives up the right
to setgid(). Upstream swapped the two (bellard/quickjs 04be246). Taken
here as is.
Neither call touches the supplementary group list and exec() inherits it,
so a privileged parent dropping to an ordinary uid left the child holding
the parent's group memberships. On z/OS that is RACF group access. When
uid or gid is given and the parent is privileged, the list is now cleared
with setgroups(0, NULL) first. setgroups() is on every platform that has
os.exec (Windows does not), so no platform scaffolding is needed; z/OS
only lacks the declaration, supplied in porting/polyfill.h.
A failed credential change in the child still exits 127, and on z/OS
also writes errno and the reason code (__errno2) to stderr, because errno
alone is useless there: EMVSERR with reason JREnvDirty is BPX.DAEMON
refusing setuid() from an address space that loaded a program that is not
program controlled. That helper lives in porting/polyfill.c.
Verified on z/OS 3.1 from JavaScript, 64-bit and 31-bit builds: with
gid only, /bin/id in the child reports no supplementary groups where the
parent carries seven; with uid, the child reports errno=157
errno2=0B8802AF and exits 127.
Signed-off-by: JoeNemo <joe.devlin@gmail.com>
Use PATH_MAX 1023 on z/OS
…groups os.exec: clear supplementary groups when dropping privileges, gid before uid
Parameter for `curl` in sigle apostrophes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Users require to compile new file
libbf.cEven so, build of configmgr fails with
which are find in libbf.c