3 ms·
This code doesn't work and has security holes via race conditions. You cannot walk a path using lstat and readlink. Once you have walked past a component you h
by jra_samba 4y ago
This code doesn't work and has security holes via race conditions.
You cannot walk a path using lstat and readlink. Once you have walked past a component you have checked, an attacker can change it to point elsewhere.
You must use openat() and readlinkat() to have any hope of symlink security.
As my talk already pointed out. The POSIX file API is impossible to use safely for programmers.
I'm afraid you just illustrated my point perfectly.
- kazinator 4y agoIt works by induction. If there is a path alpha that we somehow trust, we can also trust alpha/omega if omega is a symlink. We cannot trust what it points to, but we can trust that omega itself is not editable by an adversary. That allows us to read the symlink and continue analyzing. Anyway, I would be delighted to see a program which can fool the safepath_check function, so that it reports to user Alice that a path is safe in spite of Mallory controlling one or more components. I will try to fix the function to close the hole, and of course give full credit.