|
 |
fa19501 |
From f1188d8857f2c9773156890d0037296f5361b0bf Mon Sep 17 00:00:00 2001
|
|
|
fa19501 |
From: Jakub Filak <jfilak@redhat.com>
|
|
|
fa19501 |
Date: Wed, 6 May 2015 14:04:42 +0200
|
|
|
fa19501 |
Subject: [PATCH] daemon: harden against race conditions in DELETE
|
|
|
fa19501 |
|
|
|
fa19501 |
There is a race between checking dump dir accessibility and deleting it
|
|
|
fa19501 |
in abrt-server.
|
|
|
fa19501 |
|
|
|
fa19501 |
Related: #1214457.
|
|
|
fa19501 |
|
|
|
fa19501 |
Signed-off-by: Jakub Filak <jfilak@redhat.com>
|
|
|
fa19501 |
---
|
|
|
fa19501 |
src/daemon/abrt-server.c | 21 +++++++++++++++++++--
|
|
|
fa19501 |
1 file changed, 19 insertions(+), 2 deletions(-)
|
|
|
fa19501 |
|
|
|
fa19501 |
diff --git a/src/daemon/abrt-server.c b/src/daemon/abrt-server.c
|
|
|
fa19501 |
index 8c48509..cfdd9b7 100644
|
|
|
fa19501 |
--- a/src/daemon/abrt-server.c
|
|
|
fa19501 |
+++ b/src/daemon/abrt-server.c
|
|
|
fa19501 |
@@ -91,8 +91,16 @@ static int delete_path(const char *dump_dir_name)
|
|
|
fa19501 |
error_msg("Problem directory '%s' has wrong owner or group", dump_dir_name);
|
|
|
fa19501 |
return 400; /* */
|
|
|
fa19501 |
}
|
|
|
fa19501 |
- if (!dump_dir_accessible_by_uid(dump_dir_name, client_uid))
|
|
|
fa19501 |
+
|
|
|
fa19501 |
+ struct dump_dir *dd = dd_opendir(dump_dir_name, DD_OPEN_FD_ONLY);
|
|
|
fa19501 |
+ if (dd == NULL)
|
|
|
fa19501 |
+ {
|
|
|
fa19501 |
+ perror_msg("Can't open problem directory '%s'", dump_dir_name);
|
|
|
fa19501 |
+ return 400;
|
|
|
fa19501 |
+ }
|
|
|
fa19501 |
+ if (!dd_accessible_by_uid(dd, client_uid))
|
|
|
fa19501 |
{
|
|
|
fa19501 |
+ dd_close(dd);
|
|
|
fa19501 |
if (errno == ENOTDIR)
|
|
|
fa19501 |
{
|
|
|
fa19501 |
error_msg("Path '%s' isn't problem directory", dump_dir_name);
|
|
|
fa19501 |
@@ -102,7 +110,16 @@ static int delete_path(const char *dump_dir_name)
|
|
|
fa19501 |
return 403; /* Forbidden */
|
|
|
fa19501 |
}
|
|
|
fa19501 |
|
|
|
fa19501 |
- delete_dump_dir(dump_dir_name);
|
|
|
fa19501 |
+ dd = dd_fdopendir(dd, /*flags:*/ 0);
|
|
|
fa19501 |
+ if (dd)
|
|
|
fa19501 |
+ {
|
|
|
fa19501 |
+ if (dd_delete(dd) != 0)
|
|
|
fa19501 |
+ {
|
|
|
fa19501 |
+ error_msg("Failed to delete problem directory '%s'", dump_dir_name);
|
|
|
fa19501 |
+ dd_close(dd);
|
|
|
fa19501 |
+ return 400;
|
|
|
fa19501 |
+ }
|
|
|
fa19501 |
+ }
|
|
|
fa19501 |
|
|
|
fa19501 |
return 0; /* success */
|
|
|
fa19501 |
}
|
|
|
fa19501 |
--
|
|
|
fa19501 |
2.1.0
|
|
|
fa19501 |
|