Re: security warning

Jon Peatfield (J.S.Peatfield@damtp.cam.ac.uk)
27 Dec 1997 17:19:19 +0000


alan@lxorguk.ukuu.org.uk (Alan Cox) writes:

>
> > No, 2.0.x also followed symlinks for create(), I'm fairly certain. It used
> > to be pretty painful to do, actually, but others did it, and I think
> > people even pointed to programs that wanted it done.
>
> 2.0 does not follow the symlink for the last node of creat, and its
> vital it doesnt.
>
> ln -s /tmp/nosuchfile foofile
> ./a.out
>
> 2.0 -EEXIST
> 2.1 creates it
>
> touch /tmp/nosuchfile
>
> ./a.out
>
> 2.0 -EEXIST
> 2.1 creates it
>
> Test code
>
> #include <stdio.h>
> #include <fcntl.h>
>
> int main(int argc,char *argv[])
> {
> if(open("foofile", O_EXCL|O_CREAT|O_TRUNC, 0600)==-1)
> perror("foofile");
> return 0;
> }
>
> Alan

According to the Single Unix Spec (2nd ed) (SUS) creat() is equivalent to

open(path, O_WRONLY|O_CREAT|O_TRUNC, mode)

but this is beside the point (unless there have been crossed wires).

It is clear to me that open() with O_EXCL|OCREAT should *NOT* follow a
final symlink. The open should fail on the existance test, since a
file of the name specified exists (ok it isn't a regular file but so
what).

To quote SUS:

If O_CREAT and O_EXCL are set, open() will fail if the file exists.

It doesn't say unless that file is a symlink. No modern unix follows
the link here and Linux shouldn't either.

I think Irix 4.0 used to follow the symlink, but they fixed it before
5.0 (3+ years ago). I think that HP-UX 7.x followed symlinks like
this too, but I've not seen anything that old for at least 6 years.

-- 
Jon Peatfield,  DAMTP,  Computer Officer,   University of Cambridge
Telephone: +44 1223  3 37852    Mail: J.S.Peatfield@damtp.cam.ac.uk