From a0eecc235d3ba8ad3453da98b46c7bc3e644de75 Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue, 7 Mar 2023 19:59:23 +0200
Subject: [PATCH] xz: Make Capsicum sandbox more strict with stdin and stdout.

---
 src/xz/file_io.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/xz/file_io.c b/src/xz/file_io.c
index 37710428..ca452cdc 100644
--- a/src/xz/file_io.c
+++ b/src/xz/file_io.c
@@ -199,11 +199,19 @@ io_sandbox_enter(int src_fd)
 			CAP_EVENT, CAP_FCNTL, CAP_LOOKUP, CAP_READ, CAP_SEEK)))
 		goto capsicum_error;
 
+	if (src_fd != STDIN_FILENO && cap_rights_limit(
+			STDIN_FILENO, cap_rights_clear(&rights)))
+		goto capsicum_error;
+
 	if (cap_rights_limit(STDOUT_FILENO, cap_rights_init(&rights,
 			CAP_EVENT, CAP_FCNTL, CAP_FSTAT, CAP_LOOKUP,
 			CAP_WRITE, CAP_SEEK)))
 		goto capsicum_error;
 
+	if (cap_rights_limit(STDERR_FILENO, cap_rights_init(&rights,
+			CAP_WRITE)))
+		goto capsicum_error;
+
 	if (cap_rights_limit(user_abort_pipe[0], cap_rights_init(&rights,
 			CAP_EVENT)))
 		goto capsicum_error;