bin/185551: rsh failes if home dir is closed and access is via NFS

[Daniel Braniss]

>Number:         185551
>Category:       bin
>Synopsis:       rsh failes if home dir is closed and access is via NFS
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jan 07 12:40:00 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator:     Daniel Braniss
>Release:        FreeBSD 9.2-STABLE amd64
>Organization:
>Environment:
System: FreeBSD rnd 9.2-STABLE FreeBSD 9.2-STABLE #63: Fri Oct 18 09:53:29 IDT 2013 danny at rnd:/home/obj/rnd/r+d/stable/9/sys/HUJI amd64

	also on 10.
	
>Description:
	when the home directory of a user is open only to the owner,
	rsh will fail it's mounted via NFS, the  and the host has no root
	permition.
	The problem was diagnosed by Tomer Kleiner <mandor at cs.huji.ac.il>

>How-To-Repeat:
	chmod 700 ~
	rsh some-host-without-root-permitions
>Fix:
	this is not optimal but does fix the problem

diff -r f66afda58cc9 lib/libc/net/rcmd.c
--- a/lib/libc/net/rcmd.c	Sat Jan 04 09:12:21 2014 +0200
+++ b/lib/libc/net/rcmd.c	Mon Jan 06 13:15:01 2014 +0200
@@ -447,6 +447,7 @@
 	FILE *hostf;
 	uid_t uid;
 	int first;
+	int hostlstat;
 	char pbuf[MAXPATHLEN];
 	const struct sockaddr *raddr;
 	struct sockaddr_storage ss;
@@ -482,6 +483,7 @@
 		uid = geteuid();
 		(void)seteuid(pwd->pw_uid);
 		hostf = fopen(pbuf, "r");
+		hostlstat = lstat(pbuf, &sbuf);
 		(void)seteuid(uid);
 
 		if (hostf == NULL)
@@ -491,7 +493,7 @@
 		 * user or root or if writeable by anyone but the owner, quit.
 		 */
 		cp = NULL;
-		if (lstat(pbuf, &sbuf) < 0)
+		if (hostlstat < 0)
 			cp = ".rhosts lstat failed";
 		else if (!S_ISREG(sbuf.st_mode))
 			cp = ".rhosts not regular file";
>Release-Note:
>Audit-Trail:
>Unformatted: