Blame 0161-util-never-follow-symlinks-in-rm_rf_children.patch
|
 |
f3be585 |
From 90eb06e8c7da2c10eeccc4915bca577304785664 Mon Sep 17 00:00:00 2001
|
|
|
f3be585 |
From: Michal Schmidt <mschmidt@redhat.com>
|
|
|
f3be585 |
Date: Fri, 2 Mar 2012 10:39:10 +0100
|
|
|
f3be585 |
Subject: [PATCH] util: never follow symlinks in rm_rf_children()
|
|
|
f3be585 |
|
|
|
f3be585 |
The function checks if the entry is a directory before recursing, but
|
|
|
f3be585 |
there is a window between the check and the open, during which the
|
|
|
f3be585 |
directory could be replaced with a symlink.
|
|
|
f3be585 |
|
|
|
f3be585 |
CVE-2012-1174
|
|
|
f3be585 |
https://bugzilla.redhat.com/show_bug.cgi?id=803358
|
|
|
f3be585 |
(cherry picked from commit 5ebff5337594d690b322078c512eb222d34aaa82)
|
|
|
f3be585 |
---
|
|
|
f3be585 |
src/util.c | 3 ++-
|
|
|
f3be585 |
1 files changed, 2 insertions(+), 1 deletions(-)
|
|
|
f3be585 |
|
|
|
f3be585 |
diff --git a/src/util.c b/src/util.c
|
|
|
f3be585 |
index a488289..6a2c61f 100644
|
|
|
f3be585 |
--- a/src/util.c
|
|
|
f3be585 |
+++ b/src/util.c
|
|
|
f3be585 |
@@ -3483,7 +3483,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
|
|
|
f3be585 |
if (is_dir) {
|
|
|
f3be585 |
int subdir_fd;
|
|
|
f3be585 |
|
|
|
f3be585 |
- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
|
|
|
f3be585 |
+ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
|
|
|
f3be585 |
+ if (subdir_fd < 0) {
|
|
|
f3be585 |
if (ret == 0 && errno != ENOENT)
|
|
|
f3be585 |
ret = -errno;
|
|
|
f3be585 |
continue;
|