sync a bit w/ Net's solution to CERT-96.08.

diff --git a/usr.sbin/rpc.pcnfsd/pcnfsd_print.c b/usr.sbin/rpc.pcnfsd/pcnfsd_print.c
index 4b3394c..783bc7a 100644 (file)
--- a/usr.sbin/rpc.pcnfsd/pcnfsd_print.c
+++ b/usr.sbin/rpc.pcnfsd/pcnfsd_print.c
@@ -149,14 +149,21 @@ pr_list curr;
        return(0);
 }
 
+/*
+ * get pathname of current directory and return to client
+ *
+ * Note: This runs as root on behalf of a client request.
+ * As described in CERT advisory CA-96.08, be careful about
+ * doing a chmod on something that could be a symlink...
+ */
 pirstat pr_init(sys, pr, sp)
 char *sys;
 char *pr;
 char**sp;
 {
-int    dir_mode = 0777;
-int rc;
-mode_t oldmask;
+       int    dir_mode = 0777;
+       int rc;
+       mode_t oldmask;
 
        *sp = &pathname[0];
        pathname[0] = '\0';
@@ -164,28 +171,32 @@ mode_t oldmask;
        if(suspicious(sys) || suspicious(pr))
                return(PI_RES_FAIL);
 
-       /* get pathname of current directory and return to client */
-
+       /*
+        * Create the client spool directory if needed.
+        * Just do the mkdir call and ignore EEXIST.
+        * Mode of client directory should be 777.
+        */
        (void)sprintf(pathname,"%s/%s",sp_name, sys);
        oldmask = umask(0);
-       (void)mkdir(sp_name, dir_mode); /* ignore the return code */
        rc = mkdir(pathname, dir_mode); /* DON'T ignore this return code */
        umask(oldmask);
+
        if((rc < 0 && errno != EEXIST) ||
           (stat(pathname, &statbuf) != 0) ||
           !(statbuf.st_mode & S_IFDIR)) {
-          (void)sprintf(tempstr,
-                        "rpc.pcnfsd: unable to set up spool directory %s\n",
+               (void)sprintf(tempstr,
+                   "rpc.pcnfsd: unable to set up spool directory %s\n",
                          pathname);
-            msg_out(tempstr);
+               msg_out(tempstr);
            pathname[0] = '\0'; /* null to tell client bad vibes */
            return(PI_RES_FAIL);
-           }
-       if (!valid_pr(pr)) 
-           {
+       }
+
+       /* OK, we have a spool directory. */
+       if (!valid_pr(pr)) {
            pathname[0] = '\0'; /* null to tell client bad vibes */
            return(PI_RES_NO_SUCH_PRINTER);
-           } 
+       } 
        return(PI_RES_OK);
 
 }