svn commit: trunk/busybox/libbb

[vda at busybox.net]

Author: vda
Date: 2007-09-11 09:28:14 -0700 (Tue, 11 Sep 2007)
New Revision: 19816

Log:
cp: make it a bit closer to POSIX, but still refuse to open and
write to dest which is a symlink.



Modified:
   trunk/busybox/libbb/copy_file.c


Changeset:
Modified: trunk/busybox/libbb/copy_file.c
===================================================================
--- trunk/busybox/libbb/copy_file.c	2007-09-11 10:39:13 UTC (rev 19815)
+++ trunk/busybox/libbb/copy_file.c	2007-09-11 16:28:14 UTC (rev 19816)
@@ -141,6 +141,8 @@
 				bb_error_msg("target '%s' is not a directory", dest);
 				return -1;
 			}
+			/* race here: user can substitute a symlink between
+			 * this check and actual creation of files inside dest */
 		} else {
 			mode_t mode;
 			saved_umask = umask(0);
@@ -247,13 +249,13 @@
 			return -1;
 
 		/* POSIX way is a security problem versus symlink attacks,
-		 * we do it only for dest's which are device nodes,
-		 * and only for non-recursive, non-interactive cp. NB: it is still racy
-		 * for "cp file /home/bad_user/device_node" case
-		 * (user can rm device_node and create link to /etc/passwd) */
+		 * we do it only for non-symlinks, and only for non-recursive,
+		 * non-interactive cp. NB: it is still racy
+		 * for "cp file /home/bad_user/file" case
+		 * (user can rm file and create a link to /etc/passwd) */
 		if (DO_POSIX_CP
 		 || (dest_exists && !(flags & (FILEUTILS_RECUR|FILEUTILS_INTERACTIVE))
-		     && (S_ISBLK(dest_stat.st_mode) || S_ISCHR(dest_stat.st_mode)))
+		     && !S_ISLNK(dest_stat.st_mode))
 		) {
 			dst_fd = open(dest, O_WRONLY|O_CREAT|O_TRUNC, source_stat.st_mode);
 		} else  /* safe way: */