[LIBREPORT PATCH] never follow symlinks rhbz#887866
by Jiri Moskovcak
- use lchown instead chown and O_NOFOLLOW where we use open
---
src/lib/dump_dir.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/src/lib/dump_dir.c b/src/lib/dump_dir.c
index 57c439d..ab256da 100644
--- a/src/lib/dump_dir.c
+++ b/src/lib/dump_dir.c
@@ -116,7 +116,7 @@ static bool exist_file_dir(const char *path)
static bool not_valid_time_file(const char *filename)
{
/* Open input file, and parse it. */
- int fd = open(filename, O_RDONLY);
+ int fd = open(filename, O_RDONLY | O_NOFOLLOW);
if (fd < 0)
{
VERB2 perror_msg("Can't open '%s'", filename);
@@ -506,7 +506,7 @@ struct dump_dir *dd_create(const char *dir, uid_t uid, mode_t mode)
else
error_msg("User %lu does not exist, using gid 0", (long)uid);
- if (chown(dir, dd->dd_uid, dd->dd_gid) == -1)
+ if (lchown(dir, dd->dd_uid, dd->dd_gid) == -1)
{
perror_msg("Can't change '%s' ownership to %lu:%lu", dir,
(long)dd->dd_uid, (long)dd->dd_gid);
@@ -606,7 +606,7 @@ void dd_sanitize_mode_and_owner(struct dump_dir *dd)
chmod(full_path, dd->mode);
if (statbuf.st_uid != dd->dd_uid || statbuf.st_gid != dd->dd_gid)
{
- if (chown(full_path, dd->dd_uid, dd->dd_gid) != 0)
+ if (lchown(full_path, dd->dd_uid, dd->dd_gid) != 0)
{
perror_msg("Can't change '%s' ownership to %lu:%lu", full_path,
(long)dd->dd_uid, (long)dd->dd_gid);
@@ -708,8 +708,8 @@ int dd_delete(struct dump_dir *dd)
static char *load_text_file(const char *path, unsigned flags)
{
- FILE *fp = fopen(path, "r");
- if (!fp)
+ int fd = open(path, O_RDONLY | O_NOFOLLOW);
+ if (fd == -1)
{
if (!(flags & DD_FAIL_QUIETLY_ENOENT))
perror_msg("Can't open file '%s'", path);
@@ -718,8 +718,8 @@ static char *load_text_file(const char *path, unsigned flags)
struct strbuf *buf_content = strbuf_new();
int oneline = 0;
- int ch;
- while ((ch = fgetc(fp)) != EOF)
+ char ch;
+ while (read(fd, &ch, 1) > 0)
{
//TODO? \r -> \n?
//TODO? strip trailing spaces/tabs?
@@ -730,7 +730,7 @@ static char *load_text_file(const char *path, unsigned flags)
if (isspace(ch) || ch >= ' ') /* used !iscntrl, but it failed on unicode */
strbuf_append_char(buf_content, ch);
}
- fclose(fp);
+ close(fd);
char last = oneline != 0 ? buf_content->buf[buf_content->len - 1] : 0;
if (last == '\n')
@@ -760,7 +760,7 @@ static bool save_binary_file(const char *path, const char* data, unsigned size,
{
/* the mode is set by the caller, see dd_create() for security analysis */
unlink(path);
- int fd = open(path, O_WRONLY | O_TRUNC | O_CREAT, mode);
+ int fd = open(path, O_WRONLY | O_TRUNC | O_CREAT | O_NOFOLLOW, mode);
if (fd < 0)
{
perror_msg("Can't open file '%s'", path);
--
1.8.0.1
11 years, 3 months
[ABRT PATCH 1/2] use lchown when chowning newly created problem directory
by Jiri Moskovcak
- we don't want to follow symlinks
---
src/daemon/abrtd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/daemon/abrtd.c b/src/daemon/abrtd.c
index 577c317..23762bc 100644
--- a/src/daemon/abrtd.c
+++ b/src/daemon/abrtd.c
@@ -802,7 +802,7 @@ static void ensure_writable_dir(const char *dir, mode_t mode, const char *user)
if (!pw)
perror_msg_and_die("Can't find user '%s'", user);
- if ((sb.st_uid != pw->pw_uid || sb.st_gid != pw->pw_gid) && chown(dir, pw->pw_uid, pw->pw_gid) != 0)
+ if ((sb.st_uid != pw->pw_uid || sb.st_gid != pw->pw_gid) && lchown(dir, pw->pw_uid, pw->pw_gid) != 0)
perror_msg_and_die("Can't set owner %u:%u on '%s'", (unsigned int)pw->pw_uid, (unsigned int)pw->pw_gid, dir);
if ((sb.st_mode & 07777) != mode && chmod(dir, mode) != 0)
perror_msg_and_die("Can't set mode %o on '%s'", mode, dir);
--
1.8.0.1
11 years, 3 months
[Automatic Bug Reporting Tool - ABRT] #946: ping the sec guys about expoitable crash analysis
by fedora-badges
#946: ping the sec guys about expoitable crash analysis
----------------------+-----------------------
Reporter: jmoskovc | Owner: jmoskovc
Type: defect | Status: new
Priority: major | Milestone:
Component: abrt | Version:
Keywords: Jan2013 | Blocked By:
Blocking: |
----------------------+-----------------------
- the original tool has some licensing issues, so we have to re-implement
it
- Josh Bressers started working on it, but he too busy with something, we
need this tool to be able to detect exploitable crashes and it also has to
provide output suitable for our needs
- so we should contact Josh ask him where he left off and continue his
work
--
Ticket URL: <https://fedorahosted.org/abrt/ticket/946>
Automatic Bug Reporting Tool - ABRT <http://fedorahoted.org/abrt/>
Automatic bug reporting tool
11 years, 3 months