Skip to content

Commit

Permalink
plugins/micron: Fix code scanning alert
Browse files Browse the repository at this point in the history
Fix the time-of-check time-of-use filesystem race condition.

To use setuid() described by the JPCERT CC document as below.
  <https://www.jpcert.or.jp/research/2009/6_File_IO_Part3.pdf>
    Page 53: TOCTUC race condition measure example.
             To check the permission as same with access() function,
             Set the real user ID as the effective user ID.
             Then the race window closed between checking and using.

  Note: The example for fopen() but the fix for mkdir() and rmdir().

Signed-off-by: Tokunori Ikegami <ikegami.t@gmail.com>
  • Loading branch information
ikegami-t committed Feb 11, 2024
1 parent 83aad43 commit 589ef17
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions plugins/micron/micron-nvme.c
Original file line number Diff line number Diff line change
Expand Up @@ -311,7 +311,7 @@ static int SetupDebugDataDirectories(char *strSN, char *strFilePath,
j++;
}

if (mkdir(strMainDirName, 0777) < 0) {
if (setuid(getuid()) || mkdir(strMainDirName, 0777) < 0) {
err = -1;
goto exit_status;
}
Expand All @@ -331,7 +331,7 @@ static int SetupDebugDataDirectories(char *strSN, char *strFilePath,
rmdir(strOSDirName);
rmdir(strMainDirName);
err = -1;
}
}
}

exit_status:
Expand Down

0 comments on commit 589ef17

Please sign in to comment.