From: D Brashear <shadow@your-file-system.com>
Date: Fri, 18 Jul 2014 20:00:12 +0000 (-0400)
Subject: vlserver: limit use of regex to admins always
X-Git-Tag: upstream/1.8.0_pre1^2~288
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=049323e7e03c64f534a73ff452d218f19d5b8132;p=packages%2Fo%2Fopenafs.git

vlserver: limit use of regex to admins always

allow regexes only if the querying user is a superuser.
if the superuser uses up all the resources, well, they could just do
whatever damage directly anyway. means even in unrestricted mode
we are not vulnerable

Change-Id: Ib35d649f31e752ba5ae8373a06b67ea76f97425c
Reviewed-on: http://gerrit.openafs.org/11968
Reviewed-by: Daria Brashear <shadow@your-file-system.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
---

diff --git a/src/vlserver/vlprocs.c b/src/vlserver/vlprocs.c
index f69ba589a..6a72c94fa 100644
--- a/src/vlserver/vlprocs.c
+++ b/src/vlserver/vlprocs.c
@@ -1729,6 +1729,10 @@ ListAttributesN2(struct rx_call *rxcall,
 	findpartition = ((attributes->Mask & VLLIST_PARTITION) ? 1 : 0);
 	findflag = ((attributes->Mask & VLLIST_FLAG) ? 1 : 0);
 	if (name && (strcmp(name, ".*") != 0) && (strcmp(name, "") != 0)) {
+	    if (!afsconf_SuperUser(vldb_confdir, rxcall, NULL)) {
+		code = VL_PERM;
+		goto done;
+	    }
 	    sprintf(volumename, "^%s$", name);
 #ifdef HAVE_POSIX_REGEX
 	    if (regcomp(&re, volumename, REG_NOSUB) != 0) {