Bug 1214745

Summary:	libreport: races in dump directory handling code
Product:	Red Hat Enterprise Linux 7	Reporter:	Florian Weimer <fweimer>
Component:	libreport	Assignee:	abrt <abrt-devel-list>
Status:	CLOSED ERRATA	QA Contact:	Martin Kyral <mkyral>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.1	CC:	jfilak, mkyral
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	libreport-2.1.11-24.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1218610 (view as bug list)		Environment:
Last Closed:	2015-11-19 14:32:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1211224, 1214172, 1218610

Description Florian Weimer 2015-04-23 13:10:05 UTC

These changes are not necessary if dump directories are always root-owned and confined to direct subdirectories of /var/spool/abrt.

dd_opendir() should keep a file handle (opened with O_DIRECTORY) and use openat() and similar functions to access files in it.

dump_dir_accessible_by_uid() is fundamentally insecure because it opens up a classic time-of-check-time-of-use race between this function and and dd_opendir().  At least re-checking after dd_opendir() with the stored file descriptor is needed.

The file system manipulation functions should guard against hard links (check that link count is <= 1, just as in the user coredump code in abrt-hook-ccpp), possibly after opening the file with O_PATH first to avoid side effects on open/close.

Comment 5 errata-xmlrpc 2015-11-19 14:32:56 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2097.html