Blame SOURCES/0114-daemon-harden-against-race-conditions-in-DELETE.patch

baab13
From 10bea037a2ad82616b3698d07d07d287481e1bed Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Wed, 6 May 2015 14:04:42 +0200
baab13
Subject: [ABRT PATCH] daemon: harden against race conditions in DELETE
baab13
baab13
There is a race between checking dump dir accessibility and deleting it
baab13
in abrt-server.
baab13
baab13
Related: #1214457.
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
---
baab13
 src/daemon/abrt-server.c | 21 +++++++++++++++++++--
baab13
 1 file changed, 19 insertions(+), 2 deletions(-)
baab13
baab13
diff --git a/src/daemon/abrt-server.c b/src/daemon/abrt-server.c
baab13
index 1030461..130c24a 100644
baab13
--- a/src/daemon/abrt-server.c
baab13
+++ b/src/daemon/abrt-server.c
baab13
@@ -91,8 +91,16 @@ static int delete_path(const char *dump_dir_name)
baab13
         error_msg("Problem directory '%s' isn't owned by root:abrt or others are not restricted from access", dump_dir_name);
baab13
         return 400; /*  */
baab13
     }
baab13
-    if (!dump_dir_accessible_by_uid(dump_dir_name, client_uid))
baab13
+
baab13
+    int dir_fd = dd_openfd(dump_dir_name);
baab13
+    if (dir_fd < 0)
baab13
+    {
baab13
+        perror_msg("Can't open problem directory '%s'", dump_dir_name);
baab13
+        return 400;
baab13
+    }
baab13
+    if (!fdump_dir_accessible_by_uid(dir_fd, client_uid))
baab13
     {
baab13
+        close(dir_fd);
baab13
         if (errno == ENOTDIR)
baab13
         {
baab13
             error_msg("Path '%s' isn't problem directory", dump_dir_name);
baab13
@@ -102,7 +110,16 @@ static int delete_path(const char *dump_dir_name)
baab13
         return 403; /* Forbidden */
baab13
     }
baab13
 
baab13
-    delete_dump_dir(dump_dir_name);
baab13
+    struct dump_dir *dd = dd_fdopendir(dir_fd, dump_dir_name, /*flags:*/ 0);
baab13
+    if (dd)
baab13
+    {
baab13
+        if (dd_delete(dd) != 0)
baab13
+        {
baab13
+            error_msg("Failed to delete problem directory '%s'", dump_dir_name);
baab13
+            dd_close(dd);
baab13
+            return 400;
baab13
+        }
baab13
+    }
baab13
 
baab13
     return 0; /* success */
baab13
 }
baab13
-- 
baab13
1.8.3.1
baab13