1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
|
%% options
copyright owner = Dirk Krause
copyright year = 2015-xxxx
license = bsd
%% header
/** @file
Open file, apply additional security
checks before attempting to open the file.
Attempts to open a directory as a file are rejected.
Further optional checks can be applied to avoid:
- writing to non-regular files,
- writing to files with any symbolic link component in the path,
- writing to files via symbolic link,
- writing to files via symbolic link if link owner differs
from file owner.
*/
#ifndef DK4CONF_H_INCLUDED
#include "dk4conf.h"
#endif
#ifndef DK4TYPES_H_INCLUDED
#include "dk4types.h"
#endif
#ifndef DK4ERROR_H_INCLUDED
#include "dk4error.h"
#endif
#ifndef DK4NUMCO_H_INCLUDED
#include "dk4numco.h"
#endif
#ifndef DK4FOPT_H_INCLUDED
#include "dk4fopt.h"
#endif
#ifndef STDIO_H_INCLUDED
#include <stdio.h>
#define STDIO_H_INCLUDED 1
#endif
#ifdef __cplusplus
extern "C" {
#endif
/** Open a file after doing security checks.
CRT on Windows: Required.
@param name File name to open.
@param mode Opening mode.
@param tests Set of tests.
@param erp Error report, may be NULL.
@return Pointer to open file on success, NULL on error.
Error codes:
- DK4_E_INVALID_ARGUMENTS<br>
if name is NULL,
- DK4_E_SYNTAX<br>
if name does not refer to a regular file,
- DK4_E_NOT_SUPPORTED<br>
if no functions for wchar_t file names are available,
- DK4_E_SEC_CHECK<br>
with failed check id in iDetails1 if access is denied by additional
security checks,
- DK4_E_OPEN_WRITE_FAILED<br>
or DK4_E_OPEN_READ_FAILED with errno value in iDetails1 if fopen()
failed.
*/
FILE *
dk4fopen_wc(const wchar_t *name, const wchar_t *mode, int tests, dk4_er_t *erp);
/** Check whether we can allow to open the file.
The file must be a regular file.
Only POSIX: For root we deny opening for writing via symlink.
For all users we deny opening for writing via symlink
if the link owner is not the real file owner.
CRT on Windows: Required.
@param name File name to check.
@param ww Flag: Write access wanted.
@param tests Set of tests.
@param erp Error report, may be NULL.
@return 1 if opening the file is allowed, 0 otherwise.
Error codes:
- DK4_E_INVALID_ARGUMENTS<br>
if name is NULL,
- DK4_E_SYNTAX<br>
if name is not a regular file,
- DK4_E_SEC_CHECK<br>
if access to a symlink target is denied symlink owner and target
owner differ.
*/
int
dk4fopen_check_wc(const wchar_t *name, int ww, int tests, dk4_er_t *erp);
#ifdef __cplusplus
}
#endif
%% module
#include "dk4conf.h"
#if DK4_ON_WINDOWS
#ifndef WINDOWS_H_INCLUDED
#include <windows.h>
#define WINDOWS_H_INCLUDED 1
#endif
#endif
#include "dk4fopc8.h"
#include "dk4fopwc.h"
#ifndef DK4STAT8_H_INCLUDED
#include "dk4statw.h"
#endif
#ifndef DK4STAT_H_INCLUDED
#include "dk4stat.h"
#endif
#if DK4_HAVE_SYS_TYPES_H
#ifndef SYS_TYPES_H_INCLUDED
#include <sys/types.h>
#define SYS_TYPES_H_INCLUDED 1
#endif
#endif
#if DK4_HAVE_UNISTD_H
#ifndef UNISTD_H_INCLUDED
#include <unistd.h>
#define UNISTD_H_INCLUDED 1
#endif
#endif
#if DK4_HAVE_STRING_H
#ifndef STRING_H_INCLUDED
#include <string.h>
#define STRING_H_INCLUDED 1
#endif
#endif
#if DK4_HAVE_ERRNO_H
#ifndef ERRNO_H_INCLUDED
#include <errno.h>
#define ERRNO_H_INCLUDED 1
#endif
#endif
$!trace-include
FILE *
dk4fopen_wc(const wchar_t *name, const wchar_t *mode, int tests, dk4_er_t *erp)
{
FILE *back = NULL;
const wchar_t *cptr;
int ww = 0;
#if DK4_HAVE__WFOPEN_S
errno_t errn;
#endif
if ((NULL != name) && (NULL != mode)) {
cptr = mode;
while(*cptr) {
if (L'w' == *cptr) { ww = 1; }
if (L'a' == *cptr) { ww = 1; }
if (L'+' == *cptr) { ww = 1; }
cptr++;
}
if (0 != dk4fopen_check_wc(name, ww, tests, erp)) {
#if DK4_HAVE__WFOPEN_S
errn = _wfopen_s(&back, name, mode);
if (0 != errn) {
back = NULL;
dk4error_set_idetails(
erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errn
);
}
#else
#if DK4_HAVE__WFOPEN64
errno = 0;
back = _wfopen64(name, mode);
if (NULL == back) {
dk4error_set_idetails(
erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errno
);
}
#else
#if DK4_HAVE__WFOPEN
errno = 0;
back = _wfopen(name, mode);
if (NULL == back) {
dk4error_set_idetails(
erp, ((ww) ? DK4_E_OPEN_WRITE_FAILED : DK4_E_OPEN_READ_FAILED), errn
);
}
#else
dk4error_set_simple_error_code(erp, DK4_E_NOT_SUPPORTED);
#endif
#endif
#endif
}
} else {
dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS);
}
return back;
}
int
dk4fopen_check_wc(const wchar_t *name, int ww, int tests, dk4_er_t *erp)
{
#if DK4_ON_WINDOWS
WIN32_FIND_DATAW ffdata;
HANDLE ha;
DWORD dwattr;
int back = 1;
$? "+ dk4fopen_check_wc \"%ls\" wr=%d tests=%d", TR_LSTR(name), ww, tests
/* Check name
*/
if (NULL == name) { $? "! illegal name"
dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS);
back = 0;
goto finished;
}
/* Retrieve attributes.
*/
dwattr = GetFileAttributesW(name);
if (INVALID_FILE_ATTRIBUTES == dwattr) {
ha = FindFirstFileW(name, &ffdata);
if (INVALID_HANDLE_VALUE != ha) {
dwattr = ffdata.dwFileAttributes;
FindClose(ha);
}
}
if (INVALID_FILE_ATTRIBUTES == dwattr) { $? "! path does not exist"
goto finished;
}
/* Check directory
*/
if ((DWORD)0UL != (FILE_ATTRIBUTE_DIRECTORY & dwattr)) { $? "! dir"
back = 0;
dk4error_set_simple_error_code(erp, DK4_E_SYNTAX);
goto finished;
}
/* Check device
*/
if ((DWORD)0UL != (FILE_ATTRIBUTE_DEVICE & dwattr)) { $? "! device"
back = 0;
dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_IS_REGULAR);
}
finished:
$? "- dk4fopen_check_wc %d", back
return back;
#else
dk4_stat_t stb;
dk4_stat_t lstb;
int back = 1;
/* Check arguments.
*/
if (NULL == name) {
dk4error_set_simple_error_code(erp, DK4_E_INVALID_ARGUMENTS);
back = 0;
goto finished;
}
/* Check existing path.
*/
if (0 == dk4stat_wc(&stb, name, NULL)) {
$? ". path does not yet exist"
goto finished;
}
/* Check directory.
*/
if (0 != dk4stat_is_directory(&stb, NULL)) {
$? "! path is a directory"
dk4error_set_simple_error_code(erp, DK4_E_SYNTAX);
back = 0;
goto finished;
}
/* Write regular files only.
*/
if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_IS_REGULAR))) {
if (0 == dk4stat_is_regular(&stb, NULL)) {
$? "! not a regular file"
dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_IS_REGULAR);
back = 0;
goto finished;
}
}
#if 0
/* Do not write if any path element is a symbolic link.
NO SUCH FUNCTIONS KNOWN FOR wchar_t DATA TYPE!
*/
if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_SYMLINK_IN_PATH))) {
if (0 == dk4fopen_check_no_symlink_in_path(name)) {
$? "! symblic link in path"
dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_SYMLINK_IN_PATH);
back = 0;
goto finished;
}
}
#endif
/* Obtain symbolic link information.
*/
if (0 == dk4stat_l_wc(&lstb, name, NULL)) {
$? ". path does not yet exist or lstat() failed"
goto finished;
}
/* Do not write to file via link.
*/
if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_PATH_IS_SYMLINK))) {
if (0 != dk4stat_is_symlink(&lstb, NULL)) {
$? "! path target is symbolic link"
dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_PATH_IS_SYMLINK);
back = 0;
goto finished;
}
}
/* Do not write file via link if file owner differs from link owner.
*/
#if DK4_HAVE_FILE_UIDGID
if ((0 != ww) && (0 != (tests & DK4_FOPEN_SC_WR_SYMLINK_OWNER))) {
if (lstb.st_uid != stb.st_uid) {
$? "! link owner is not file owner"
dk4error_set_idetails(erp, DK4_E_SEC_CHECK, DK4_FOPEN_SC_WR_SYMLINK_OWNER);
back = 0;
goto finished;
}
}
#endif
finished:
return back;
#endif
}
|