%% options copyright owner = Dirk Krause copyright year = 2015-xxxx license = bsd %% header /** @file Open file, apply additional security checks before attempting to open the file. Attempts to open a directory as a file are rejected. Further optional checks can be applied to avoid: - writing to non-regular files, - writing to files with any symbolic link component in the path, - writing to files via symbolic link, - writing to files via symbolic link if link owner differs from file owner. */ #ifndef DK4CONF_H_INCLUDED #include "dk4conf.h" #endif #ifndef DK4TYPES_H_INCLUDED #include "dk4types.h" #endif #ifndef DK4ERROR_H_INCLUDED #include "dk4error.h" #endif #ifndef DK4NUMCO_H_INCLUDED #include "dk4numco.h" #endif #ifndef DK4FOPT_H_INCLUDED #include "dk4fopt.h" #endif #ifndef STDIO_H_INCLUDED #include #define STDIO_H_INCLUDED 1 #endif #ifdef __cplusplus extern "C" { #endif /** Open a file after doing security checks. CRT on Windows: Required. @param name File name to open. @param mode Opening mode. @param tests Set of tests. @param erp Error report, may be NULL. @return Pointer to open file on success, NULL on error. Error codes: - DK4_E_INVALID_ARGUMENTS
if name is NULL, - DK4_E_SYNTAX
if name does not refer to a regular file, - DK4_E_NOT_SUPPORTED
if no functions for wchar_t file names are available, - DK4_E_SEC_CHECK
with failed check id in iDetails1 if access is denied by additional security checks, - DK4_E_OPEN_WRITE_FAILED
or DK4_E_OPEN_READ_FAILED with errno value in iDetails1 if fopen() failed. */ FILE * dk4fopen_wc(const wchar_t *name, const wchar_t *mode, int tests, dk4_er_t *erp); /** Check whether we can allow to open the file. The file must be a regular file. Only POSIX: For root we deny opening for writing via symlink. For all users we deny opening for writing via symlink if the link owner is not the real file owner. CRT on Windows: Required. @param name File name to check. @param ww Flag: Write access wanted. @param tests Set of tests. @param erp Error report, may be NULL. @return 1 if opening the file is allowed, 0 otherwise. Error codes: - DK4_E_INVALID_ARGUMENTS
if name is NULL, - DK4_E_SYNTAX
if name is not a regular file, - DK4_E_SEC_CHECK
if access to a symlink target is denied symlink owner and target owner differ. */ int dk4fopen_check_wc(const wchar_t *name, int ww, int tests, dk4_er_t *erp); #ifdef __cplusplus } #endif %% module #include "dk4conf.h" #if DK4_ON_WINDOWS #ifndef WINDOWS_H_INCLUDED #include #define WINDOWS_H_INCLUDED 1 #endif #endif #include "dk4fopc8.h" #include "dk4fopwc.h" #ifndef DK4STAT8_H_INCLUDED #include "dk4statw.h" #endif #ifndef DK4STAT_H_INCLUDED #include "dk4stat.h" #endif #if DK4_HAVE_SYS_TYPES_H #ifndef SYS_TYPES_H_INCLUDED #include #define SYS_TYPES_H_INCLUDED 1 #endif #endif #if DK4_HAVE_UNISTD_H #ifndef UNISTD_H_INCLUDED #include #define UNISTD_H_INCLUDED 1 #endif #endif #if DK4_HAVE_STRING_H #ifndef STRING_H_INCLUDED #include #define STRING_H_INCLUDED 1 #endif #endif #if DK4_HAVE_ERRNO_H #ifndef ERRNO_H_INCLUDED #include #define ERRNO_H_INCLUDED 1 #endif #endif $!trace-include FILE * dk4fopen_wc(const wchar_t *name, const wchar_t *mode, int tests, dk4_er_t *erp) { FILE *back = NULL; const wchar_t *cptr; int ww = 0; #if DK4_HAVE__WFOPEN_S errno_t errn; #endif if ((NULL != name) && (NULL != mode)) { cptr = mode; while(*cptr) { if (L'w' == *cptr) { ww = 1; } if (L'a' == *cptr) { ww = 1; } if (L'+' == *cptr) { ww = 1; } cptr++; } if (0 != dk4fopen_check_wc(name, ww, tests, erp)) { #if DK4_HAVE__WFOPEN_S errn = _wfopen_s(&back, name, mode); if (0 != errn) { back = NULL; dk4error_set_idetails( erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errn ); } #else #if DK4_HAVE__WFOPEN64 errno = 0; back = _wfopen64(name, mode); if (NULL == back) { dk4error_set_idetails( erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errno ); } #else #if DK4_HAVE__WFOPEN errno = 0; back = _wfopen(name, mode); if (NULL == back) { dk4error_set_idetails( erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errn ); } #else dk4error_set_simple_error_code(erp, DK4_E_NOT_SUPPORTED); #endif #endif #endif } } else { dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS); } return back; } int dk4fopen_check_wc(const wchar_t *name, int ww, int tests, dk4_er_t *erp) { #if DK4_ON_WINDOWS WIN32_FIND_DATAW ffdata; HANDLE ha; DWORD dwattr; int back = 1; $? "+ dk4fopen_check_wc \"%ls\" wr=%d tests=%d", TR_LSTR(name), ww, tests /* Check name */ if (NULL == name) { $? "! illegal name" dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS); back = 0; goto finished; } /* Retrieve attributes. */ dwattr = GetFileAttributesW(name); if (INVALID_FILE_ATTRIBUTES == dwattr) { ha = FindFirstFileW(name, &ffdata); if (INVALID_HANDLE_VALUE != ha) { dwattr = ffdata.dwFileAttributes; FindClose(ha); } } if (INVALID_FILE_ATTRIBUTES == dwattr) { $? "! path does not exist" goto finished; } /* Check directory */ if ((DWORD)0UL != (FILE_ATTRIBUTE_DIRECTORY & dwattr)) { $? "! dir" back = 0; dk4error_set_simple_error_code(erp, DK4_E_SYNTAX); goto finished; } /* Check device */ if ((DWORD)0UL != (FILE_ATTRIBUTE_DEVICE & dwattr)) { $? "! device" back = 0; dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_IS_REGULAR); } finished: $? "- dk4fopen_check_wc %d", back return back; #else dk4_stat_t stb; dk4_stat_t lstb; int back = 1; /* Check arguments. */ if (NULL == name) { dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS); back = 0; goto finished; } /* Check existing path. */ if (0 == dk4stat_wc(&stb, name, NULL)) { $? ". path does not yet exist" goto finished; } /* Check directory. */ if (0 != dk4stat_is_directory(&stb, NULL)) { $? "! path is a directory" dk4error_set_simple_error_code(erp, DK4_E_SYNTAX); back = 0; goto finished; } /* Write regular files only. */ if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_IS_REGULAR))) { if (0 == dk4stat_is_regular(&stb, NULL)) { $? "! not a regular file" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_IS_REGULAR); back = 0; goto finished; } } #if 0 /* Do not write if any path element is a symbolic link. NO SUCH FUNCTIONS KNOWN FOR wchar_t DATA TYPE! */ if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_SYMLINK_IN_PATH))) { if (0 == dk4fopen_check_no_symlink_in_path(name)) { $? "! symblic link in path" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_SYMLINK_IN_PATH); back = 0; goto finished; } } #endif /* Obtain symbolic link information. */ if (0 == dk4stat_l_wc(&lstb, name, NULL)) { $? ". path does not yet exist or lstat() failed" goto finished; } /* Do not write to file via link. */ if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_PATH_IS_SYMLINK))) { if (0 != dk4stat_is_symlink(&lstb, NULL)) { $? "! path target is symbolic link" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_PATH_IS_SYMLINK); back = 0; goto finished; } } /* Do not write file via link if file owner differs from link owner. */ #if DK4_HAVE_FILE_UIDGID if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_SYMLINK_OWNER))) { if (lstb.st_uid != stb.st_uid) { $? "! link owner is not file owner" dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_SYMLINK_OWNER); back = 0; goto finished; } } #endif finished: return back; #endif }