summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Schmidt <mschmidt@redhat.com>2012-03-02 10:39:10 +0100
committerMichal Schmidt <mschmidt@redhat.com>2012-03-16 18:33:02 +0100
commit5ebff5337594d690b322078c512eb222d34aaa82 (patch)
treefa41ee9d34437f1fcc914f31cff51c6b7808c579
parent16f1239e1ece27257c0deedcf01aa39474f66241 (diff)
util: never follow symlinks in rm_rf_children()
The function checks if the entry is a directory before recursing, but there is a window between the check and the open, during which the directory could be replaced with a symlink. CVE-2012-1174 https://bugzilla.redhat.com/show_bug.cgi?id=803358
-rw-r--r--src/util.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/util.c b/src/util.c
index 20cbc2b0db..dfc1dc6b85 100644
--- a/src/util.c
+++ b/src/util.c
@@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
if (is_dir) {
int subdir_fd;
- if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
+ subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
+ if (subdir_fd < 0) {
if (ret == 0 && errno != ENOENT)
ret = -errno;
continue;