Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Bugtraq: Re: Symlinks and Cryogenic Sleep

Re: Symlinks and Cryogenic Sleep

From: <pedward_at_WEBCOM.COM>
Date: Tue, 4 Jan 2000 14:16:55 -0800

Why not do an:

fd = open(file, O_RDWR);

fstat(fd, &fi);

lstat(file, &li);

if (fi.st_ino == li.st_ino && fi.st_dev == li.st_dev && S_ISREG(fi.st_mode)) {
        /* it's a real, plain, file */
}

That guarantees that the directory structure reflects your file descriptor.

 The method below has a race condition, you're not checking that the file
you opened is legitmate, youre lstat proves nothing. The race exists because there
is no fstat.

 You could open the link, replace the link with a file, lstat would be cool, and then
reopen the link for writing.

 In the above, you'd open the link, get the inode info on the file that the link
pointed to, lstat the link, and compare the results.

Obviously the linked to file couldn't have the same dev/inode as the link, and you
obviously couldn't put the actual file there, so there is no race.

--Perry

> I did something that way:
>
> FILE *DoOpen(const char *cpFile, long bAppend)
> {
> FILE *spNew;
> FILE *spTest;
> struct stat sStat;
>
> spTest = fopen(cpFile,"a");
> if (!spTest)
> {
> Log("ERR FILE OPEN",cpFile);
> return NULL;
> }
> if (lstat(cpFile,&sStat))
> {
> Log("ERR STAT",cpFile);
> return NULL;
> }
> if ((sStat.st_mode & S_IFMT) == S_IFLNK)
> {
> fclose(spTest);
> Log("ERR ISLINK",cpFile);
> return NULL;
> }
> if (bAppend)
> spNew = spTest;
> else
> {
> spNew = freopen(cpFile,"w",spTest);
> fclose(spTest);
> }
> if (!spNew)
> {
> Log("ERR FILE OPEN",cpFile);
> return NULL;
> }
> return spFile;
> }
>
> Comments ?
> Improvements ?
>
> By
>
> Goetz

--
Perry Harrington                 Director of                   zelur xuniL  ()
perry_at_webcom.com             System Architecture               Think Blue.  /\
Received on Jan 05 2000
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos