%% options copyright owner = Dirk Krause copyright year = 2015-xxxx license = bsd %% header /** @file Open file, apply additional security checks before attempting to open the file. Attempts to open a directory as a file are rejected. Further optional checks can be applied to avoid: - writing to non-regular files, - writing to files with any symbolic link component in the path, - writing to files via symbolic link, - writing to files via symbolic link if link owner differs from file owner. */ #ifndef DK4CONF_H_INCLUDED #include "dk4conf.h" #endif #ifndef DK4TYPES_H_INCLUDED #include "dk4types.h" #endif #ifndef DK4ERROR_H_INCLUDED #include "dk4error.h" #endif #ifndef DK4NUMCO_H_INCLUDED #include "dk4numco.h" #endif #ifndef DK4FOPT_H_INCLUDED #include "dk4fopt.h" #endif #ifndef STDIO_H_INCLUDED #include #define STDIO_H_INCLUDED 1 #endif #ifdef __cplusplus extern "C" { #endif /** Open a file after doing security checks. CRT on Windows: Required. @param name File name to open. @param mode Opening mode. @param tests Set of tests. @param erp Error report, may be NULL. @return Pointer to open file on success, NULL on error. Error codes: - DK4_E_INVALID_ARGUMENTS
if name is NULL, - DK4_E_SYNTAX
if name does not refer to a regular file, - DK4_E_SEC_CHECK
with failed echek id (DK4_FOPEN_SC_WR_PATH_IS_SYMLINK or DK4_FOPEN_SC_WR_SYMLINK_OWNER) in iDetails1 if access is denied by additional security checks, - DK4_E_OPEN_WRITE_FAILED
or DK4_E_OPEN_READ_FAILED with errno value in iDetails1 if fopen() failed. */ FILE * dk4fopen_c8(const char *name, const char *mode, int tests, dk4_er_t *erp); /** Check whether we can allow to open the file. The file must be a regular file. Only POSIX: For root we deny opening for writing via symlink. For all users we deny opening for writing via symlink if the link owner is not the real file owner. CRT on Windows: Required. @param name File name to check. @param ww Flag: Write access wanted. @param tests Set of tests. @param erp Error report, may be NULL. @return 1 if opening the file is allowed, 0 otherwise. Error codes: - DK4_E_INVALID_ARGUMENTS
if name is NULL, - DK4_E_SYNTAX
if name is not a regular file, - DK4_E_SEC_CHECK
if access to a symlink target is denied symlink owner and target owner differ. */ int dk4fopen_check_c8(const char *name, int ww, int tests, dk4_er_t *erp); #ifdef __cplusplus } #endif %% module #include "dk4conf.h" #if DK4_ON_WINDOWS #ifndef WINDOWS_H_INCLUDED #include #define WINDOWS_H_INCLUDED 1 #endif #endif #include "dk4fopc8.h" #ifndef DK4STAT8_H_INCLUDED #include "dk4stat8.h" #endif #ifndef DK4STAT_H_INCLUDED #include "dk4stat.h" #endif #ifndef DK4MPL_H_INCLUDED #include "dk4mpl.h" #endif #ifndef DK4STR8_H_INCLUDED #include "dk4str8.h" #endif #if DK4_HAVE_SYS_TYPES_H #ifndef SYS_TYPES_H_INCLUDED #include #define SYS_TYPES_H_INCLUDED 1 #endif #endif #if DK4_HAVE_UNISTD_H #ifndef UNISTD_H_INCLUDED #include #define UNISTD_H_INCLUDED 1 #endif #endif #if DK4_HAVE_ERRNO_H #ifndef ERRNO_H_INCLUDED #include #define ERRNO_H_INCLUDED 1 #endif #endif $!trace-include #if !DK4_ON_WINDOWS #if DK4_HAVE_BACKSLASH_AS_SEP /** Path component separator. */ static const unsigned char sep = '\\'; #else /** Path component separator. */ static const unsigned char sep = '/'; #endif /** Check whether one of the components in the path is a symbolic link. @param name Path name to check. @return 1 if there is no symlink in the path, 0 otherwise. */ static int dk4fopen_check_no_symlink_in_path(const char *name) { char buf[DK4_MAX_PATH]; dk4_stat_t lstb; char *p1; int back = 0; if (sizeof(buf) > dk4str8_len(name)) { back = 1; dk4str8_cpy_s(buf, sizeof(buf), name, NULL); p1 = dk4str8_chr(buf, sep); while ((NULL != p1) && (1 == back)) { *p1 = '\0'; if (0 < dk4str8_len(buf)) { if (0 != dk4stat_l_c8(&lstb, buf, NULL)) { if (0 != dk4stat_is_symlink(&lstb, NULL)) { back = 0; } } } *(p1++) = sep; p1 = dk4str8_chr(p1, sep); } } return back; } #endif int dk4fopen_check_c8(const char *name, int ww, int tests, dk4_er_t *erp) { #if DK4_ON_WINDOWS WIN32_FIND_DATAA ffdata; HANDLE ha; DWORD dwattr; int back = 1; $? "+ dk4fopen_check_c8 \"%!8s\" wr=%d tests=%d", TR_8STR(name), ww, tests /* Check name */ if (NULL == name) { $? "! illegal name" dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS); back = 0; goto finished; } /* Retrieve attributes. */ dwattr = GetFileAttributesA(name); if (INVALID_FILE_ATTRIBUTES == dwattr) { ha = FindFirstFileA(name, &ffdata); if (INVALID_HANDLE_VALUE != ha) { dwattr = ffdata.dwFileAttributes; FindClose(ha); } } if (INVALID_FILE_ATTRIBUTES == dwattr) { $? "! path does not exist" goto finished; } /* Check directory */ if ((DWORD)0UL != (FILE_ATTRIBUTE_DIRECTORY & dwattr)) { $? "! dir" back = 0; dk4error_set_simple_error_code(erp, DK4_E_SYNTAX); goto finished; } /* Check device */ if ((DWORD)0UL != (FILE_ATTRIBUTE_DEVICE & dwattr)) { $? "! device" back = 0; dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_IS_REGULAR); } finished: $? "- dk4fopen_check_c8 %d", back return back; #else dk4_stat_t stb; dk4_stat_t lstb; int back = 1; $? "+ dk4fopen_check_c8 \"%!8s\" wr=%d tests=%d", TR_8STR(name), ww, tests /* Check name argument. */ if (NULL == name) { dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS); back = 0; goto finished; } /* Check existing path. */ if (0 == dk4stat_c8(&stb, name, NULL)) { $? ". path does not yet exist" goto finished; } /* Check directory. */ if (0 != dk4stat_is_directory(&stb, NULL)) { $? "! path is a directory" dk4error_set_simple_error_code(erp, DK4_E_SYNTAX); back = 0; goto finished; } /* Write regular files only. */ if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_IS_REGULAR))) { if (0 == dk4stat_is_regular(&stb, NULL)) { $? "! not a regular file" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_IS_REGULAR); back = 0; goto finished; } } /* Do not write if any path element is a symbolic link. */ if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_SYMLINK_IN_PATH))) { if (0 == dk4fopen_check_no_symlink_in_path(name)) { $? "! symblic link in path" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_SYMLINK_IN_PATH); back = 0; goto finished; } } /* Obtain symbolic link information. */ if (0 == dk4stat_l_c8(&lstb, name, NULL)) { $? ". path does not yet exist or lstat() failed" goto finished; } /* Do not write to file via link. */ if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_PATH_IS_SYMLINK))) { if (0 != dk4stat_is_symlink(&lstb, NULL)) { $? "! path target is symbolic link" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_PATH_IS_SYMLINK); back = 0; goto finished; } } /* Do not write file via link if file owner differs from link owner. */ #if DK4_HAVE_FILE_UIDGID if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_SYMLINK_OWNER))) { if (lstb.st_uid != stb.st_uid) { $? "! link owner is not file owner" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_SYMLINK_OWNER); back = 0; goto finished; } } #endif finished: $? "- dk4fopen_check_c8 %d", back return back; #endif } FILE * dk4fopen_c8(const char *name, const char *mode, int tests, dk4_er_t *erp) { FILE *back = NULL; /* Result */ const char *cptr; /* Traverse mode */ int ww = 0; /* Flag: Want to write */ #if DK4_HAVE_FOPEN_S errno_t errn; #endif if ((NULL != name) && (NULL != mode)) { cptr = mode; while (*cptr) { switch (*cptr) { case 'w': case 'a': case '+': { ww = 1; } break; } cptr++; } if (0 != dk4fopen_check_c8(name, ww, tests, erp)) { #if DK4_HAVE_FOPEN_S errn = fopen_s(&back, name, mode); if (0 != errn) { back = NULL; dk4error_set_idetails( erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errn ); } #else #if DK4_HAVE_FOPEN64 errno = 0; back = fopen64(name, mode); if (NULL == back) { dk4error_set_idetails( erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errno ); } #else errno = 0; back = fopen(name, mode); if (NULL == back) { dk4error_set_idetails( erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errno ); } #endif #endif } } else { dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS); } return back; }