[Midnightbsd-cvs] [MidnightBSD/src] 4181a1: prowld: fix security issues from fast-forward review

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/src
  Commit: 4181a11793c5a6130626bf0c70ad7272b2e3fae3
      https://github.com/MidnightBSD/src/commit/4181a11793c5a6130626bf0c70ad7272b2e3fae3
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-04-20 (Mon, 20 Apr 2026)

  Changed paths:
    M lib/libsystemd/sd-daemon.c
    M lib/libsystemd/sd-journal.c
    M sbin/prowl-generator/prowl-generator.c
    M sbin/prowld/ipc.c
    M sbin/prowld/prowld.h
    M sbin/prowld/rcshim.c
    M sbin/prowld/supervisor.c
    M sbin/prowld/unit.c
    M usr.sbin/bsdinstall/scripts/netconfig
    M usr.sbin/service/service.sh

  Log Message:
  -----------
  prowld: fix security issues from fast-forward review

service.sh: replace eval+grep shell injection with safe sed extraction
  that only accepts identifier-safe chars; drop invalid env -L -/daemon flags.

ipc.c: JSON-escape label/state in ipc_broadcast_event; validate rc_name
  before run_sysrc; check kevent return in ipc_accept; log truncation
  warning in cmd_list.

supervisor.c: remove dead ucl_object_emit_full call; only rename timer
  state file if ucl_object_emit succeeds (prevents OOM-induced data
  loss); add O_NOFOLLOW to timer tmp file; use fchmod(fd) in
  notify_socket_open instead of path-based chmod; use execve+minimal_env
  for mDNS dns-sd child; cap EXTEND_TIMEOUT_USEC to 300 s; rate-limit
  mDNS re-registration to once per 10 s.

unit.c: use lstat + S_ISREG check for unit files; replace lstat+opendir
  drop-in pattern with open(O_NOFOLLOW|O_DIRECTORY)+fdopendir to close
  TOCTOU; reject drop-in filenames containing '/'; check
  ucl_parser_add_file return for base unit on drop-in re-parse.

rcshim.c: replace fopen with open(O_NOFOLLOW)+fdopen to close TOCTOU
  between lstat security check and file read.

sd-daemon.c: check strdup return in sd_listen_fds_with_names and free
  on OOM; use lstat in sd_booted.

sd-journal.c: clamp PRIORITY values to LOG_EMERG..LOG_DEBUG range in
  sd_journal_send and sd_journal_sendv.

prowl-generator.c: JSON-escape all strings written to generated output
  to prevent malformed unit files from scripts with special characters.

netconfig: quote $IF and $BSDINSTALL_TMPETC throughout to handle paths
  with spaces and prevent word splitting.

AI-Assisted-by: Claude Sonnet 4.6
Signed-off-by: Lucas Holt <luke at MidnightBSD.org>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications