From ce7d0e05de76ae5383bcdfdba3ffa8816ffb63bd Mon Sep 17 00:00:00 2001

From: Jakub Filak <jfilak@redhat.com>

Date: Wed, 13 May 2015 13:05:48 +0200

Subject: [PATCH] ccpp: make saving of binary more robust

Do not override existing files (defend against hard | symbolic link

attacks) and use the *at functions (defend against race conditions).

Signed-off-by: Jakub Filak <jfilak@redhat.com>

---

 src/hooks/abrt-hook-ccpp.c | 12 +++++-------

 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c

index 8f3b2b0..9d9f549 100644

--- a/src/hooks/abrt-hook-ccpp.c

+++ b/src/hooks/abrt-hook-ccpp.c

@@ -379,7 +379,7 @@ static int test_configuration(bool setting_SaveFullCore, bool setting_CreateCore

     return 0;

 }

-int save_crashing_binary(pid_t pid, const char *dest_path, uid_t uid, gid_t gid)

+static int save_crashing_binary(pid_t pid, struct dump_dir *dd)

 {

     char buf[sizeof("/proc/%lu/exe") + sizeof(long)*3];

@@ -391,15 +391,15 @@ int save_crashing_binary(pid_t pid, const char *dest_path, uid_t uid, gid_t gid)

         return 0;

     }

-    int dst_fd = open(dest_path, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_DUMP_DIR_MODE);

+    int dst_fd = openat(dd->dd_fd, FILENAME_BINARY, O_WRONLY | O_CREAT | O_EXCL | O_TRUNC, DEFAULT_DUMP_DIR_MODE);

     if (dst_fd < 0)

     {

-        log_notice("Failed to create file '%s'", dest_path);

+        log_notice("Failed to create file '"FILENAME_BINARY"' at '%s'", dd->dd_dirname);

         close(src_fd_binary);

         return -1;

     }

-    IGNORE_RESULT(fchown(dst_fd, uid, gid));

+    IGNORE_RESULT(fchown(dst_fd, dd->dd_uid, dd->dd_gid));

     off_t sz = copyfd_eof(src_fd_binary, dst_fd, COPYFD_SPARSE);

     close(src_fd_binary);

@@ -701,9 +701,7 @@ int main(int argc, char** argv)

         if (setting_SaveBinaryImage)

         {

-            strcpy(path + path_len, "/"FILENAME_BINARY);

-

-            if (save_crashing_binary(pid, path, dd->dd_uid, dd->dd_gid))

+            if (save_crashing_binary(pid, dd))

             {

                 error_msg("Error saving '%s'", path);

-- 

2.1.0