[SSSD] [PATCH] Protect against check-and-open race conditions

Jakub Hrozek jhrozek at redhat.com
Fri Apr 2 10:00:41 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/01/2010 10:20 PM, Stephen Gallagher wrote:
> There is a small window between running lstat() on a filename and
> opening it where it's possible for the file to have been modified.
> We were protecting against this by saving the stat data from the
> original file and verifying that it was the same file (by device
> and inode) when we opened it again, but this is an imperfect
> solution, as it is still possible for an attacker to modify the
> permissions during this window.
> 
> It is much better to simply open the file and test on the active
> file descriptor.
> 
> Resolves https://fedorahosted.org/sssd/ticket/425 incidentally, as
> without the initial lstat, we are implicitly accepting symlinks
> and only verifying the target file.
> 
> 

Well, this changes the semantics of the calls a little as it is not
possible to check for symlinks anymore..granted we don't need it in the
code right now

As per the code  only couple of nits: the DEBUG() call on line 163
should say "check_fd failed"

Why does the check_fd call accept an external stat buf? It is not
defined in any header file, perhaps it should be made static..did you
envision exporting it in the future similar to check_file()?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAku1wD8ACgkQHsardTLnvCXALgCeK2ONal8Nu02tebjFTC5GLI7M
0VYAoIZnASz1l6Fv7N+i/vGj7gs9NGf8
=ZCQv
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list