From 06eeacb6fe029804f296b065b3ce91e796e1cd0e Mon Sep 17 00:00:00 2001 From: Mantas Mikulėnas Date: Fri, 29 Jan 2016 23:36:08 +0200 Subject: basic: fix touch() creating files with 07777 mode mode_t is unsigned, so MODE_INVALID < 0 can never be true. This fixes a possible DoS where any user could fill /run by writing to a world-writable /run/systemd/show-status. --- src/basic/fs-util.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/basic') diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c index d31bd6e273..61b651b573 100644 --- a/src/basic/fs-util.c +++ b/src/basic/fs-util.c @@ -341,7 +341,8 @@ int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gi if (parents) mkdir_parents(path, 0755); - fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, mode > 0 ? mode : 0644); + fd = open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, + (mode == 0 || mode == MODE_INVALID) ? 0644 : mode); if (fd < 0) return -errno; -- cgit v1.2.3-54-g00ecf