Bug 101316

Summary:	/bin/sh pwd bug after cd into restricted directory
Product:	Base System	Reporter:	Aragon Gouveia <aragon>
Component:	bin	Assignee:	Stefan Farfeleder <stefanf>
Status:	Closed FIXED
Severity:	Affects Only Me
Priority:	Normal
Version:	6.1-RELEASE
Hardware:	Any
OS:	Any

Description Aragon Gouveia 2006-08-03 13:00:34 UTC

After attempting (and failing) to cd into a directory whose permissions
restrict that access, the $PWD and output of pwd reflect that I am in that
directory.  But performing a file listing confirms that I am not.

How-To-Repeat: $ cd /var/db
$ ls -l
total 974
drwx------   2 operator  operator     512 Aug  3 11:44 entropy
drwx------   2 root      wheel        512 May  7 03:54 ipf
-r--r--r--   1 nobody    wheel     953165 Jul 29 04:15 locate.database
-rw-r--r--   1 root      wheel          0 Jul 12 09:10 mountdtab
-rw-r--r--   1 root      wheel          7 Aug  3 11:07 ntp.drift
drwxr-xr-x  35 root      wheel       1024 Jul 18 11:04 pkg
drwxr-xr-x   8 root      wheel        512 Jul 18 10:59 ports
drwxr-xr-x   2 root      wheel        512 May  7 03:54 portsnap
drwxr-xr-x  46 root      wheel       1024 Jul 14 09:21 sup
$ pwd
/var/db
$ cd ipf
cd: can't cd to ipf
$ pwd
/var/db/ipf
$ ls -l
total 974
drwx------   2 operator  operator     512 Aug  3 11:44 entropy
drwx------   2 root      wheel        512 May  7 03:54 ipf
-r--r--r--   1 nobody    wheel     953165 Jul 29 04:15 locate.database
-rw-r--r--   1 root      wheel          0 Jul 12 09:10 mountdtab
-rw-r--r--   1 root      wheel          7 Aug  3 11:07 ntp.drift
drwxr-xr-x  35 root      wheel       1024 Jul 18 11:04 pkg
drwxr-xr-x   8 root      wheel        512 Jul 18 10:59 ports
drwxr-xr-x   2 root      wheel        512 May  7 03:54 portsnap
drwxr-xr-x  46 root      wheel       1024 Jul 14 09:21 sup
$ cd ..
$ pwd
/var/db
$ ls -l
total 974
drwx------   2 operator  operator     512 Aug  3 11:44 entropy
drwx------   2 root      wheel        512 May  7 03:54 ipf
-r--r--r--   1 nobody    wheel     953165 Jul 29 04:15 locate.database
-rw-r--r--   1 root      wheel          0 Jul 12 09:10 mountdtab
-rw-r--r--   1 root      wheel          7 Aug  3 11:07 ntp.drift
drwxr-xr-x  35 root      wheel       1024 Jul 18 11:04 pkg
drwxr-xr-x   8 root      wheel        512 Jul 18 10:59 ports
drwxr-xr-x   2 root      wheel        512 May  7 03:54 portsnap
drwxr-xr-x  46 root      wheel       1024 Jul 14 09:21 sup

Comment 1 Michael MacInnis 2006-08-18 16:42:20 UTC

Adding a call to updatepwd(NULL) in cd.c seems to fix the problem:

@@ -202,6 +202,7 @@
 
 	INTOFF;
 	if (updatepwd(badstat ? NULL : dest) < 0 || chdir(curdir) < 0) {
+		updatepwd(NULL);
 		INTON;
 		return (-1);
 	}

This may also address PR bin/64990.

Michael MacInnis.

Comment 2 le freebsd_committer

2007-03-30 18:00:34 UTC

Responsible Changed
From-To: freebsd-bugs->stefanf

Over to maintainer.

Comment 3 dfilter service freebsd_committer

2008-02-24 16:51:01 UTC

stefanf     2008-02-24 16:50:55 UTC

  FreeBSD src repository

  Modified files:
    bin/sh               cd.c 
  Log:
  Split updatepwd() into two smaller functions.  The first one, findpwd(),
  computes the new path and the second one, updatepwd(), updates the variables
  PWD, OLDPWD and the path used for the pwd builtin according to the new
  directory.  For a logical directory change, chdir() is now called between
  those two functions, no longer causing wrong values to be stored in PWD etc. if
  it fails.
  
  PR:     64990, 101316, 120571
  
  Revision  Changes    Path
  1.36      +45 -38    src/bin/sh/cd.c
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"

Comment 4 Stefan Farfeleder freebsd_committer

2008-02-24 16:53:02 UTC

State Changed
From-To: open->patched

Fixed in HEAD.

Comment 5 Stefan Farfeleder freebsd_committer

2008-04-20 19:10:42 UTC

State Changed
From-To: patched->closed

Merged to RELENG_6 and RELENG_7.