[2897] in Kerberos-V5-bugs
pending/565: Re: BUG: possible lib/krb4/tf_util.c race condition
daemon@ATHENA.MIT.EDU (Larry Schwimmer)
Wed Mar 18 20:39:05 1998
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: gnats-admin@rt-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU,
Larry Schwimmer <schwim@whatmore.Stanford.EDU>
Date: Wed, 18 Mar 1998 17:38:33 -0800 (PST)
From: Larry Schwimmer <schwim@whatmore.Stanford.EDU>
Cc: krb5-bugs@MIT.EDU, schwim@leland.Stanford.EDU
In-Reply-To: <199803172350.PAA29584@whatmore.Stanford.EDU> from "Larry Schwimmer" at Mar 17, 98 03:50:32 pm
>Number: 565
>Category: pending
>Synopsis: Re: BUG: possible lib/krb4/tf_util.c race condition
>Confidential: yes
>Severity: serious
>Priority: medium
>Responsible: gnats-admin
>State: open
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Wed Mar 18 20:39:00 EST 1998
>Last-Modified:
>Originator:
>Organization:
>Release:
>Environment:
>Description:
>How-To-Repeat:
>Fix:
>Audit-Trail:
>Unformatted:
You (Larry Schwimmer) write:
> Submitter-Id: net
> Originator: Larry Schwimmer
> Confidential: no
> Synopsis: tf_init has a /tmp race condition
> Severity: serious
> Priority: medium
> Category: krb5-libs
> Class: sw-bug
> Release: 1.0.5
> Environment: All
Sample patch included at the end of the note. It's basically
the same for the krb4 and krb5 distributions.
yours,
Larry Schwimmer
schwim@leland.stanford.edu
Leland Systems Group
--- lib/krb4/tf_util.c.orig Fri Feb 6 19:44:22 1998
+++ lib/krb4/tf_util.c Wed Mar 18 17:31:55 1998
@@ -278,10 +278,26 @@
#endif /* TKT_SHMEM */
if (wflag) {
- fd = open(tf_name, O_RDWR, 0600);
+ fd = open(tf_name, O_RDWR|O_CREAT|O_EXCL, 0600);
if (fd < 0) {
return TKT_FIL_ACC;
}
+ if (fstat(fd, &stat_buf) < 0) {
+ (void) close(fd);
+ fd = -1;
+ switch (errno) {
+ case ENOENT:
+ return NO_TKT_FIL;
+ default:
+ return TKT_FIL_ACC;
+ }
+ }
+ if ((stat_buf.st_uid != me && me != 0) ||
+ ((stat_buf.st_mode & S_IFMT) != S_IFREG)) {
+ (void) close(fd);
+ fd = -1;
+ return TKT_FIL_ACC;
+ }
if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
sleep(TF_LCK_RETRY);
if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
@@ -297,8 +313,24 @@
* for read-only operations and locked for shared access.
*/
- fd = open(tf_name, O_RDONLY, 0600);
+ fd = open(tf_name, O_RDONLY|O_NONBLOCK, 0600);
if (fd < 0) {
+ return TKT_FIL_ACC;
+ }
+ if (fstat(fd, &stat_buf) < 0) {
+ (void) close(fd);
+ fd = -1;
+ switch (errno) {
+ case ENOENT:
+ return NO_TKT_FIL;
+ default:
+ return TKT_FIL_ACC;
+ }
+ }
+ if ((stat_buf.st_uid != me && me != 0) ||
+ ((stat_buf.st_mode & S_IFMT) != S_IFREG)) {
+ (void) close(fd);
+ fd = -1;
return TKT_FIL_ACC;
}
if (flock(fd, LOCK_SH | LOCK_NB) < 0) {
