X-Git-Url: http://gitweb.michael.orlitzky.com/?a=blobdiff_plain;f=src%2Fapply-default-acl.c;h=4a6ef765e10379d213661dacf39d8a08636cb20c;hb=6d396c52c731f260cc261e26c75034bd5007f0b0;hp=465f70ad9794f55220f43abb8692d833238d2e4d;hpb=b70d254436f1c3304d5ae98e82cb81340854d820;p=apply-default-acl.git diff --git a/src/apply-default-acl.c b/src/apply-default-acl.c index 465f70a..4a6ef76 100644 --- a/src/apply-default-acl.c +++ b/src/apply-default-acl.c @@ -10,6 +10,7 @@ #define _GNU_SOURCE #include +#include /* AT_FOO constants */ #include /* nftw() et al. */ #include #include /* dirname() */ @@ -50,19 +51,44 @@ mode_t get_mode(const char* path) { } struct stat s; - int result = stat(path, &s); + int result = lstat(path, &s); if (result == 0) { return s.st_mode; } else { - /* errno will be set already by stat() */ + /* errno will be set already by lstat() */ return result; } } +/** + * @brief Determine if the given path might refer to an (unsafe) hard link. + * + * @param path + * The path to test. + * + * @return true if we are certain that @c path does not refer to a hard + * link, and false otherwise. In case of error, false is returned, + * because we are not sure that @c path is not a hard link. + */ +bool is_hardlink_safe(const char* path) { + if (path == NULL) { + return false; + } + struct stat s; + int result = lstat(path, &s); + if (result == 0) { + return (s.st_nlink == 1 || S_ISDIR(s.st_mode)); + } + else { + return false; + } +} + + /** * @brief Determine whether or not the given path is a regular file. * @@ -77,7 +103,7 @@ bool is_regular_file(const char* path) { } struct stat s; - int result = stat(path, &s); + int result = lstat(path, &s); if (result == 0) { return S_ISREG(s.st_mode); } @@ -88,6 +114,42 @@ bool is_regular_file(const char* path) { +/** + * @brief Determine whether or not the given path is accessible. + * + * @param path + * The path to test. + * + * @return true if @c path is accessible to the current effective + * user/group, false otherwise. + */ +bool path_accessible(const char* path) { + if (path == NULL) { + return false; + } + + /* Test for access using the effective user and group rather than + the real one. */ + int flags = AT_EACCESS; + + /* Don't follow symlinks when checking for a path's existence, + since we won't follow them to set its ACLs either. */ + flags |= AT_SYMLINK_NOFOLLOW; + + /* If the path is relative, interpret it relative to the current + working directory (just like the access() system call). */ + int result = faccessat(AT_FDCWD, path, F_OK, flags); + + if (result == 0) { + return true; + } + else { + return false; + } +} + + + /** * @brief Determine whether or not the given path is a directory. * @@ -96,13 +158,13 @@ bool is_regular_file(const char* path) { * * @return true if @c path is a directory, false otherwise. */ -bool is_directory(const char* path) { +bool is_path_directory(const char* path) { if (path == NULL) { return false; } struct stat s; - int result = stat(path, &s); + int result = lstat(path, &s); if (result == 0) { return S_ISDIR(s.st_mode); } @@ -207,7 +269,13 @@ int acl_set_entry(acl_t* aclp, ACL. */ acl_entry_t new_entry; - /* We allocate memory here that we should release! */ + /* The acl_create_entry() function can allocate new memory and/or + * change the location of the ACL structure entirely. When that + * happens, the value pointed to by aclp is updated, which means + * that a new acl_t gets "passed out" to our caller, eventually to + * be fed to acl_free(). In other words, we should still be freeing + * the right thing, even if the value pointed to by aclp changes. + */ int c_result = acl_create_entry(aclp, &new_entry); if (c_result == ACL_ERROR) { perror("acl_set_entry (acl_create_entry)"); @@ -250,20 +318,20 @@ int acl_set_entry(acl_t* aclp, * @brief Determine the number of entries in the given ACL. * * @param acl - * A pointer to an @c acl_t structure. + * The ACL to inspect. * * @return Either the non-negative number of entries in @c acl, or * @c ACL_ERROR on error. */ -int acl_entry_count(acl_t* acl) { +int acl_entry_count(acl_t acl) { acl_entry_t entry; int entry_count = 0; - int result = acl_get_entry(*acl, ACL_FIRST_ENTRY, &entry); + int result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); while (result == ACL_SUCCESS) { entry_count++; - result = acl_get_entry(*acl, ACL_NEXT_ENTRY, &entry); + result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); } if (result == ACL_ERROR) { @@ -282,14 +350,14 @@ int acl_entry_count(acl_t* acl) { * An ACL is minimal if it has fewer than four entries. * * @param acl - * A pointer to an acl_t structure. + * The ACL whose minimality is in question. * * @return * - @c ACL_SUCCESS - @c acl is minimal * - @c ACL_FAILURE - @c acl is not minimal * - @c ACL_ERROR - Unexpected library error */ -int acl_is_minimal(acl_t* acl) { +int acl_is_minimal(acl_t acl) { int ec = acl_entry_count(acl); @@ -309,29 +377,17 @@ int acl_is_minimal(acl_t* acl) { /** - * @brief Determine whether the given path has an ACL whose mask - * denies execute. + * @brief Determine whether the given ACL's mask denies execute. * - * @param path - * The path to check. + * @param acl + * The ACL whose mask we want to check. * * @return - * - @c ACL_SUCCESS - @c path has a mask which denies execute. - * - @c ACL_FAILURE - The ACL for @c path does not deny execute, - * or @c path has no extended ACL at all. + * - @c ACL_SUCCESS - The @c acl has a mask which denies execute. + * - @c ACL_FAILURE - The @c acl has a mask which does not deny execute. * - @c ACL_ERROR - Unexpected library error. */ -int acl_execute_masked(const char* path) { - - acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); - - if (acl == (acl_t)NULL) { - perror("acl_execute_masked (acl_get_file)"); - return ACL_ERROR; - } - - /* Our return value. */ - int result = ACL_FAILURE; +int acl_execute_masked(acl_t acl) { acl_entry_t entry; int ge_result = acl_get_entry(acl, ACL_FIRST_ENTRY, &entry); @@ -342,8 +398,7 @@ int acl_execute_masked(const char* path) { if (tag_result == ACL_ERROR) { perror("acl_execute_masked (acl_get_tag_type)"); - result = ACL_ERROR; - goto cleanup; + return ACL_ERROR; } if (tag == ACL_MASK) { @@ -354,15 +409,13 @@ int acl_execute_masked(const char* path) { int ps_result = acl_get_permset(entry, &permset); if (ps_result == ACL_ERROR) { perror("acl_execute_masked (acl_get_permset)"); - result = ACL_ERROR; - goto cleanup; + return ACL_ERROR; } int gp_result = acl_get_perm(permset, ACL_EXECUTE); if (gp_result == ACL_ERROR) { perror("acl_execute_masked (acl_get_perm)"); - result = ACL_ERROR; - goto cleanup; + return ACL_ERROR; } if (gp_result == ACL_FAILURE) { @@ -374,9 +427,7 @@ int acl_execute_masked(const char* path) { ge_result = acl_get_entry(acl, ACL_NEXT_ENTRY, &entry); } - cleanup: - acl_free(acl); - return result; + return ACL_FAILURE; } @@ -405,7 +456,7 @@ int acl_execute_masked(const char* path) { */ int any_can_execute_or_dir(const char* path) { - if (is_directory(path)) { + if (is_path_directory(path)) { /* That was easy... */ return ACL_SUCCESS; } @@ -420,7 +471,7 @@ int any_can_execute_or_dir(const char* path) { /* Our return value. */ int result = ACL_FAILURE; - if (acl_is_minimal(&acl)) { + if (acl_is_minimal(acl)) { mode_t mode = get_mode(path); if (mode & (S_IXUSR | S_IXOTH | S_IXGRP)) { result = ACL_SUCCESS; @@ -471,7 +522,7 @@ int any_can_execute_or_dir(const char* path) { if (gp_result == ACL_SUCCESS) { /* Only return ACL_SUCCESS if this execute bit is not masked. */ - if (acl_execute_masked(path) != ACL_SUCCESS) { + if (acl_execute_masked(acl) != ACL_SUCCESS) { result = ACL_SUCCESS; goto cleanup; } @@ -494,59 +545,49 @@ int any_can_execute_or_dir(const char* path) { /** - * @brief Inherit the default ACL from @c parent to @c path. - * - * The @c parent parameter does not necessarily need to be the parent - * of @c path, although that will usually be the case. This overwrites - * any existing default ACL on @c path. + * @brief Set @c acl as the default ACL on @c path if it's a directory. * - * @param parent - * The parent directory whose ACL we want to inherit. + * This overwrites any existing default ACL on @c path. If no default + * ACL exists, then one is created. If @c path is not a directory, we + * return ACL_FAILURE but no error is raised. * * @param path - * The target directory whose ACL we wish to overwrite (or create). + * The target directory whose ACL we wish to replace or create. + * + * @param acl + * The ACL to set as default on @c path. * * @return - * - @c ACL_SUCCESS - The default ACL was inherited successfully. - * - @c ACL_FAILURE - Either @c parent or @c path is not a directory. + * - @c ACL_SUCCESS - The default ACL was assigned successfully. + * - @c ACL_FAILURE - If @c path is not a directory. * - @c ACL_ERROR - Unexpected library error. */ -int inherit_default_acl(const char* path, const char* parent) { - - /* Our return value. */ - int result = ACL_SUCCESS; +int assign_default_acl(const char* path, acl_t acl) { if (path == NULL) { errno = ENOENT; return ACL_ERROR; } - if (!is_directory(path) || !is_directory(parent)) { + if (!is_path_directory(path)) { return ACL_FAILURE; } - acl_t parent_acl = acl_get_file(parent, ACL_TYPE_DEFAULT); - if (parent_acl == (acl_t)NULL) { - perror("inherit_default_acl (acl_get_file)"); - return ACL_ERROR; - } - - acl_t path_acl = acl_dup(parent_acl); + /* Our return value; success unless something bad happens. */ + int result = ACL_SUCCESS; + acl_t path_acl = acl_dup(acl); if (path_acl == (acl_t)NULL) { perror("inherit_default_acl (acl_dup)"); - acl_free(parent_acl); - return ACL_ERROR; + return ACL_ERROR; /* Nothing to clean up in this case. */ } int sf_result = acl_set_file(path, ACL_TYPE_DEFAULT, path_acl); if (sf_result == -1) { perror("inherit_default_acl (acl_set_file)"); result = ACL_ERROR; - goto cleanup; } - cleanup: acl_free(path_acl); return result; } @@ -641,7 +682,33 @@ int apply_default_acl(const char* path, bool no_exec_mask) { return ACL_ERROR; } - if (!is_regular_file(path) && !is_directory(path)) { + /* Refuse to operate on hard links, which can be abused by an + * attacker to trick us into changing the ACL on a file we didn't + * intend to; namely the "target" of the hard link. To truly prevent + * that sort of mischief, we should be using file descriptors for + * the target and its parent directory. Then modulo a tiny race + * condition, we would be sure that "path" and "parent" don't change + * their nature between the time that we test them and when we + * utilize them. For contrast, the same attacker is free to replace + * "path" with a hard link after is_hardlink_safe() has returned + * "true" below. + * + * Unfortunately, our API is lacking in this area. For example, + * acl_set_fd() is only capable of setting the ACL_TYPE_ACCESS list, + * and not the ACL_TYPE_DEFAULT. Apparently the only way to operate + * on default ACLs is through the path name, which is inherently + * unreliable since the acl_*_file() calls themselves might follow + * links (both hard and symbolic). + * + * Some improvement could still be made by using descriptors where + * possible -- this would shrink the exploit window -- but for now + * we use a naive implementation that only keeps honest men honest. + */ + if (!is_hardlink_safe(path)) { + return ACL_FAILURE; + } + + if (!is_regular_file(path) && !is_path_directory(path)) { return ACL_FAILURE; } @@ -651,7 +718,7 @@ int apply_default_acl(const char* path, bool no_exec_mask) { path_copy[PATH_MAX-1] = 0; char* parent = dirname(path_copy); - if (!is_directory(parent)) { + if (!is_path_directory(parent)) { /* Make sure dirname() did what we think it did. */ return ACL_FAILURE; } @@ -694,11 +761,12 @@ int apply_default_acl(const char* path, bool no_exec_mask) { acl_t acl = acl_get_file(path, ACL_TYPE_ACCESS); if (acl == (acl_t)NULL) { perror("apply_default_acl (acl_get_file)"); - return ACL_ERROR; + result = ACL_ERROR; + goto cleanup; } /* If it's a directory, inherit the parent's default. */ - int inherit_result = inherit_default_acl(path, parent); + int inherit_result = assign_default_acl(path, defacl); if (inherit_result == ACL_ERROR) { perror("apply_default_acl (inherit_acls)"); result = ACL_ERROR; @@ -754,7 +822,22 @@ int apply_default_acl(const char* path, bool no_exec_mask) { } } - /* Finally, add the permset to the access ACL. */ + /* Finally, add the permset to the access ACL. It's actually + * important that we pass in the address of "acl" here, and not + * "acl" itself. Why? The call to acl_create_entry() within + * acl_set_entry() can allocate new memory for the entry. + * Sometimes that can be done in-place, in which case everything + * is cool and the new memory gets released when we call + * acl_free(acl). + * + * But occasionally, the whole ACL structure will have to be moved + * in order to allocate the extra space. When that happens, + * acl_create_entry() modifies the pointer it was passed (in this + * case, &acl) to point to the new location. We want to call + * acl_free() on the new location, and since acl_free() gets + * called right here, we need acl_create_entry() to update the + * value of "acl". To do that, it needs the address of "acl". + */ int set_result = acl_set_entry(&acl, entry); if (set_result == ACL_ERROR) { perror("apply_default_acl (acl_set_entry)"); @@ -884,7 +967,7 @@ int apply_default_acl_nftw_x(const char *target, */ bool apply_default_acl_recursive(const char *target, bool no_exec_mask) { - if (!is_directory(target)) { + if (!is_path_directory(target)) { return apply_default_acl(target, no_exec_mask); } @@ -971,11 +1054,22 @@ int main(int argc, char* argv[]) { const char* target = argv[arg_index]; bool reapp_result = false; + /* Make sure we can access the given path before we go out of our + * way to please it. Doing this check outside of + * apply_default_acl() lets us spit out a better error message for + * typos, too. + */ + if (!path_accessible(target)) { + fprintf(stderr, "%s: %s: No such file or directory\n", argv[0], target); + result = EXIT_FAILURE; + continue; + } + if (recursive) { reapp_result = apply_default_acl_recursive(target, no_exec_mask); } else { - /* It's either normal file, or we're not operating recursively. */ + /* It's either a normal file, or we're not operating recursively. */ reapp_result = apply_default_acl(target, no_exec_mask); }