kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Protect from symlink-following attacks

Browse Source 
Files in the zkey repository can be created by any member of the
'zkeyadm' group as well as 'root'. Such files are owned by the creator
and the 'zkeyadm' group, and allow read and write for the owner user
and owner group.

When creating or writing files inside the zkey repository, make sure
that the file is not a sysmlink. That way, only files within the zkey
repository are set to be read/write for the owner user and members of
the 'zkeyadm' group. Make sure to open such files with the 'O_NOFOLLOW'
flag, and use 'lstat()' to check for files and directories.

Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-30 09:46:27 +02:00
committed by Jan Höppner
parent 278f4f6fd5
commit 94292dac54
7 changed files with 104 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/properties.c
+2 -1
View File
@@ -22,6 +22,7 @@
#include "lib/util_panic.h"
#include "properties.h"
#include "utils.h"
struct properties {
struct util_list list;
@@ -312,7 +313,7 @@ int properties_save(struct properties *properties, const char *filename,
util_assert(properties != NULL, "Internal error: properties is NULL");
util_assert(filename != NULL, "Internal error: filename is NULL");
fp = fopen(filename, "w");
fp = fopen_nofollow(filename, "w");
if (fp == NULL)
return -EIO;