Re: encapsulating directory operations

On 2025-06-02, Scott Lurndal <scott@slp53.sl.home> wrote:

From the posix standard:
>
  "The purpose of the fstatat() function is to obtain the status
   of files in directories other than the current working directory
   without exposure to race conditions. Any part of the path of a
   file could be changed in parallel to a call to stat(), resulting
   in unspecified behavior. By opening a file descriptor for the target
   directory and using the fstatat() function it can be guaranteed that
   the file for which status is returned is located relative to the desired directory."

The security guarantee you want is that when you follow some path
/a/b/c/d/.., that none of the path components "a", "b", "c", "d", ...
are under the control of an adversary. Adversary means any other user
who is not you or root. (If you are root, any other user, therefore).

If, say "c" is under the control of an adversary, then the adversary can
make it a symlink, so that "d" is then anything whatsoever in any
location whatsoever.

I've developed an experimental security library called safepath
which tries to validate a path for this kind of safety.

https://www.kylheku.com/cgit/safepath/about/

Caveat: note the lack of a test suite in this project!

It doesn't rely on these functions because, it's not necesary.
If you know that /a/b/c is safe, then by induction you can proceed
to /a/b/c/d. For instance if you are root, and non-root is not able
to tamper with /a/b/c, then, generally speaking, there is no race
condition to worry about in making two accesses to c: one to check its
permissions and ownership, and another to traverse it.

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca