CVE-2015-1869

@@ -487,7 +487,7 @@ static gboolean key_value_ok(gchar *key, gchar *value)
         }
     }
 
-    return TRUE;
+    return allowed_new_user_problem_entry(client_uid, key, value);
 }
 
 /* Handles a message received from client over socket. */

@@ -168,13 +168,20 @@ bool allowed_problem_dir(const char *dir_name)
 
 static char *handle_new_problem(GVariant *problem_info, uid_t caller_uid, char **error)
 {
+    char *problem_id = NULL;
     problem_data_t *pd = problem_data_new();
 
     GVariantIter *iter;
     g_variant_get(problem_info, "a{ss}", &iter);
     gchar *key, *value;
     while (g_variant_iter_loop(iter, "{ss}", &key, &value))
     {
+        if (allowed_new_user_problem_entry(caller_uid, key, value) == false)
+        {
+            *error = xasprintf("You are not allowed to create element '%s' containing '%s'", key, value);
+            goto finito;
+        }
+
         problem_data_add_text_editable(pd, key, value);
     }
 
@@ -189,12 +196,13 @@ static char *handle_new_problem(GVariant *problem_info, uid_t caller_uid, char *
     /* At least it should generate local problem identifier UUID */
     problem_data_add_basics(pd);
 
-    char *problem_id = problem_data_save(pd);
+    problem_id = problem_data_save(pd);
     if (problem_id)
         notify_new_path(problem_id);
     else if (error)
         *error = xasprintf("Cannot create a new problem");
 
+finito:
     problem_data_free(pd);
     return problem_id;
 }

@@ -51,6 +51,8 @@ char *get_backtrace(const char *dump_dir_name, unsigned timeout_sec, const char
 bool dir_is_in_dump_location(const char *dir_name);
 #define dir_has_correct_permissions abrt_dir_has_correct_permissions
 bool dir_has_correct_permissions(const char *dir_name);
+#define allowed_new_user_problem_entry abrt_allowed_new_user_problem_entry
+bool allowed_new_user_problem_entry(uid_t uid, const char *name, const char *value);
 
 #define g_settings_nMaxCrashReportsSize abrt_g_settings_nMaxCrashReportsSize
 extern unsigned int  g_settings_nMaxCrashReportsSize;

@@ -483,3 +483,27 @@ bool dir_has_correct_permissions(const char *dir_name)
     }
     return true;
 }
+
+bool allowed_new_user_problem_entry(uid_t uid, const char *name, const char *value)
+{
+    /* Allow root to create everything */
+    if (uid == 0)
+        return true;
+
+    /* Permit non-root users to create everything except: analyzer and type */
+    if (strcmp(name, FILENAME_ANALYZER) != 0
+     && strcmp(name, FILENAME_TYPE) != 0
+     /* compatibility value used in abrt-server */
+     && strcmp(name, "basename") != 0)
+        return true;
+
+    /* Permit non-root users to create all types except: C/C++, Koops, vmcore and xorg */
+     if (strcmp(value, "CCpp") != 0
+      && strcmp(value, "Kerneloops") != 0
+      && strcmp(value, "vmcore") != 0
+      && strcmp(value, "xorg") != 0)
+        return true;
+
+    error_msg("Only root is permitted to create element '%s' containing '%s'", name, value);
+    return false;
+}

@@ -178,16 +178,6 @@ static int run_post_create(const char *dirname)
             return 403;
         }
     }
-    else if (!dump_dir_accessible_by_uid(dirname, client_uid))
-    {
-        if (errno == ENOTDIR)
-        {
-            error_msg("Path '%s' isn't problem directory", dirname);
-            return 404; /* Not Found */
-        }
-        error_msg("Problem directory '%s' can't be accessed by user with uid %ld", dirname, (long)client_uid);
-        return 403; /* Forbidden */
-    }
 
     int child_stdout_fd;
     int child_pid = spawn_event_handler_child(dirname, "post-create", &child_stdout_fd);
@@ -741,14 +731,21 @@ static int perform_http_xact(void)
     /* Body received, EOF was seen. Don't let alarm to interrupt after this. */
     alarm(0);
 
+    int ret = 0;
     if (url_type == CREATION_NOTIFICATION)
     {
+        if (client_uid != 0)
+        {
+            error_msg("UID=%ld is not authorized to trigger post-create processing", (long)client_uid);
+            ret = 403; /* Forbidden */
+            goto out;
+        }
+
         messagebuf_data[messagebuf_len] = '\0';
         return run_post_create(messagebuf_data);
     }
 
     /* Save problem dir */
-    int ret = 0;
     unsigned pid = convert_pid(problem_info);
     die_if_data_is_missing(problem_info);