[DragonFlyBSD - Bug #3420] Command injection in netif

[sigttou]

Issue #3420 has been updated by sigttou.


Both patches stop the injection. rc.conf parsing is not affected
by either patch.

But the command strings (start_cmd, start_precmd, ...) are shell code.
Running $_cmd directly only word-splits it, so shell syntax is lost.
DPorts use this, for example:

    stop_postcmd="[ -f ${pidfile} ] && rm ${pidfile}"
    restart_cmd="pop3d_cmd stop && pop3d_cmd start"
    start_cmd="daemon ... > ${log} 2>&1"

_run_rc_doit has the same problem: pydio-cells calls
_run_rc_doit "kill -TERM ${rc_pid}", which needs eval "$@".

My patch only takes the extra service(8) arguments out of eval:

    eval $_cmd '"$@"'

The command string is still eval'd, so config does not change. The extra
arguments stay data.

If you drop eval for the command strings too, those rc scripts break.

----------------------------------------
Bug #3420: Command injection in netif
http://bugs.dragonflybsd.org/issues/3420#change-14714

* Author: namiarj
* Status: New
* Priority: Normal
* Category: Userland
* Target version: 6.6
* Start date: 2026-09-10
----------------------------------------
The netif script is susceptible to command injection and glob expansion. The root cause seems to be the use of evals in /etc/network.subr. Reproduction:

@service netif start “;id;”@

The command injection and glob bug can be combined:
@touch “/tmp/;id;”
service netif start /tmp/*@

It also affects rc.conf this makes command injection persistent across boots and a command like reboot can make the system stuck in loops:
@sysrc ifconfig_wlan0=“;reboot;”@

For context:
https://lists.freebsd.org/archives/freebsd-bugs/2026-August/035962.html

---Files--------------------------------
dragonfly-issue-3420-hardening.patch (4.37 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account