kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdev: use rename-file to avoid any symlinks created

Browse Source 
During the boot, the ZDEV_SITE_ID is derived with the help
of loadparm and will be saved in ZDEV_SITE_ID_FILE, which
will be the used by the udev-rules.

ZDEV_SITE_ID_FILE creation can have a surface of symlink attack
as we are directly using the fopen and fprintf on it. To avoid
this, make sure that we are writing the ZDEV_SITE_ID to a temporary
file, which will then be renamed to ZDEV_SITE_ID_FILE, which will
remove all the existing symlinks associated with the target file.

Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Vineeth Vijayan
2023-06-07 14:10:57 +02:00
committed by Jan Höppner
parent 27902c9106
commit 09c01e580a
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
zdev/src/zdev_id.c
View File

@@ -213,9 +213,16 @@ out:
static void write_zdev_site_id(int site_id)
{
FILE *fd;
int rc;
int tmpfd, rc;
const char zdev_id_file[] = ZDEV_SITE_ID_FILE;
char zdev_id_tmpfile[] = ZDEV_SITE_ID_FILE "-XXXXXX";
fd = fopen(ZDEV_SITE_ID_FILE, "w");
tmpfd = mkstemp(zdev_id_tmpfile);
if (tmpfd == -1)
goto err;
/* Open the temp file to use with fprintf */
fd = fdopen(tmpfd, "w");
if (!fd)
goto err;
@@ -232,6 +239,12 @@ static void write_zdev_site_id(int site_id)
if (fclose(fd))
goto err;
/* Rename the temporary file to ZDEV_SITE_ID_FILE*/
if (rename(zdev_id_tmpfile, zdev_id_file) == -1) {
remove(zdev_id_tmpfile);
goto err;
}
return;
err:
err(1, "Could not write to zdev_site_id file");