Rui Lopes dijo [Mon, Sep 29, 2008 at 08:47:23AM +0100]:
> Gunnar Wolf wrote:
> >Jeremy Chadwick dijo [Fri, Sep 26, 2008 at 07:37:19PM -0700]: [...]
> > case cherokee_logger_writer_file:
> >+ /* Check against symlink attacks */
> >+ r = stat (writer->filename.buf, &info);
> >+ /* Disregard if the stat failed - The file does not exist,
> >so everything is fine */
> >+ if (r == 0 and S_ISLINK(info.st_mode) == 0) {
> >+ PRINT_MSG ("%s unsafe for opening: Is a symlink\n",
> >writer->filename.buf);
> >+ return ret_error
> >+ }
> >+
> > writer->fd = open (writer->filename.buf, O_APPEND | O_WRONLY
> > | O_CREAT | O_LARGEFILE, 0
> >
>
> Isn't this flawed by a race condition (stat-before-open)? There is
> a O_NOFOLLOW (at least on FreeBSD [1] and Linux [2]) flag to open(2)
> for this "do not open a symlink" scenario.
Yes, I noticed the race condition, but was unable to provide for
anything better. NOFOLLOW looks much better - Do you know if it is
supported on any other OSs (at least, OSs which provide symlink
semantics). Another course of action can be the lstat-fopen-fstat [1],
which seems more universal (although a bit uglier as well)
> BTW, I find the open logs as user flawed (the user can mess with the
> logs if allowed to run its own code in the daemon account); IMHO the
> route followed by daemontools [3] is the nicer one: the daemon just
> logs to stdout and another process writes to disk (or other place).
Yes, I also prefer this logic - But the default Cherokee configuration
logs directly to the specified files. And anyway, many users will
still prefer specifying the log destination straight to Cherokee, as
it is somewhat easier to keep things tidy by having them in a single
place (i.e. one logfile per vhost or such).
[1]
https://www.securecoding.cert.org/confluence/display/seccode/POS01-C.+Check+for+the+existence+of+links+when+dealing+with+files
--
Gunnar Wolf - [EMAIL PROTECTED] - (+52-55)5623-0154 / 1451-2244
PGP key 1024D/8BB527AF 2001-10-23
Fingerprint: 0C79 D2D1 2C4E 9CE4 5973 F800 D80E F35A 8BB5 27AF
_______________________________________________
Cherokee mailing list
[email protected]
http://lists.octality.com/listinfo/cherokee
