d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a SECURITY CONSIDERATIONS example: make note that access to open

Browse Source 
file descriptors does not change upon dropping privilege, and include
a likely case of `setuid(non_superuser); exec(...);'.

Sponsored by:	DARPA, NAI Labs
Obtained from:	TrustedBSD Project
This commit is contained in:
chris 2002-07-03 08:13:25 +00:00
parent bf33ab99c5
commit 306b98b34d
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
lib/libc/sys/setuid.2
View File

@ -128,6 +128,39 @@ The functions will fail if:
The user is not the super user and the ID The user is not the super user and the ID
specified is not the real, effective ID, or saved ID. specified is not the real, effective ID, or saved ID.
.El .El
.Sh SECURITY CONSIDERATIONS
Read and write permissions to files are determined upon a call to
.Xr open 2 .
Once a file descriptor is open, dropping privilege does not affect
the process's read/write permissions, even if the user ID specified
has no read or write permissions to the file.
These files normally remain open in any new process executed,
resulting in a user being able to read or modify
potentially sensitive data.
.Pp
To prevent these files from remaining open after an
.Xr exec 3
call, be sure to set the close-on-exec flag is set:
.Bd -literal
void
pseudocode(void)
{
int fd;
/* ... */
fd = open("/path/to/sensitive/data", O_RDWR);
if (fd == -1)
err(1, "open");
/*
* Set close-on-exec flag; see fcntl(2) for more information.
*/
if (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1)
err(1, "fcntl(F_SETFD)");
/* ... */
execve(path, argv, environ);
}
.Ed
.Sh SEE ALSO .Sh SEE ALSO
.Xr getgid 2 , .Xr getgid 2 ,
.Xr getuid 2 , .Xr getuid 2 ,