mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
94292dac54
Files in the zkey repository can be created by any member of the 'zkeyadm' group as well as 'root'. Such files are owned by the creator and the 'zkeyadm' group, and allow read and write for the owner user and owner group. When creating or writing files inside the zkey repository, make sure that the file is not a sysmlink. That way, only files within the zkey repository are set to be read/write for the owner user and members of the 'zkeyadm' group. Make sure to open such files with the 'O_NOFOLLOW' flag, and use 'lstat()' to check for files and directories. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>