Gunnar Wolf wrote:
> Rui Lopes dijo [Mon, Sep 29, 2008 at 08:47:23AM +0100]:
>
>> Gunnar Wolf wrote:
>>
>>> Jeremy Chadwick dijo [Fri, Sep 26, 2008 at 07:37:19PM -0700]: [...]
>>> case cherokee_logger_writer_file:
>>> + /* Check against symlink attacks */
>>> + r = stat (writer->filename.buf, &info);
>>> + /* Disregard if the stat failed - The file does not exist,
>>> so everything is fine */
>>> + if (r == 0 and S_ISLINK(info.st_mode) == 0) {
>>> + PRINT_MSG ("%s unsafe for opening: Is a symlink\n",
>>> writer->filename.buf);
>>> + return ret_error
>>> + }
>>> +
>>> writer->fd = open (writer->filename.buf, O_APPEND | O_WRONLY
>>> | O_CREAT | O_LARGEFILE, 0
>>>
>>>
>> Isn't this flawed by a race condition (stat-before-open)? There is
>> a O_NOFOLLOW (at least on FreeBSD [1] and Linux [2]) flag to open(2)
>> for this "do not open a symlink" scenario.
>>
>
> Yes, I noticed the race condition, but was unable to provide for
> anything better. NOFOLLOW looks much better - Do you know if it is
> supported on any other OSs (at least, OSs which provide symlink
> semantics). Another course of action can be the lstat-fopen-fstat [1],
> which seems more universal (although a bit uglier as well)
>
I don't known others.
The link [1] you provided is nice; it even has where O_NOFOLLOW is
supposed to work:
"""
Compliant Solution (Linux 2.1.126+, FreeBSD, Solaris 10, POSIX.1-2008
O_NOFOLLOW)
"""
For other OSes I guess the lstat dance could be encapsulated.
Best regards,
Rui Lopes
[1]
https://www.securecoding.cert.org/confluence/display/seccode/POS01-C.+Check+for+the+existence+of+links+when+dealing+with+files
_______________________________________________
Cherokee mailing list
[email protected]
http://lists.octality.com/listinfo/cherokee
