kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libkmipclient: Protect from symlink-following attacks

Browse Source 
When creating or writing files, make sure that the file is not a
sysmlink. Such files created by libkmipclient are typically stored inside
the zkey repository and the owner and mode of them are changed to.
allow read/write for the owner user and the 'zkeyadm' group. It
would allow a symlink-following attack if the file being created are
symlinks. Make sure to open such files with the 'O_NOFOLLOW' flag.

Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-30 09:52:15 +02:00
committed by Jan Höppner
parent a3a2d70603
commit f0bf1985c3
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libkmipclient/utils.h
+2
View File
@@ -58,4 +58,6 @@ void kmip_node_dump(struct kmip_node *node, bool debug);
enum kmip_tag kmip_find_v1_attribute_name_tag(struct kmip_node *parent);
FILE *fopen_nofollow(const char *path, const char *mode);
#endif