summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeff Layton <jlayton@redhat.com>2009-09-25 06:45:10 -0400
committerKarolin Seeger <kseeger@samba.org>2009-10-01 14:29:18 +0200
commite3dd6f99a4a7b87399bb5cfe4d3e06ac4d78c81f (patch)
tree6ddbe42dd94bd171c9ff47c11b50bfd57f901b11
parentc173c1beb1334fcdcf55e458430341f193482b2e (diff)
downloadsamba-e3dd6f99a4a7b87399bb5cfe4d3e06ac4d78c81f.tar.gz
samba-e3dd6f99a4a7b87399bb5cfe4d3e06ac4d78c81f.tar.bz2
samba-e3dd6f99a4a7b87399bb5cfe4d3e06ac4d78c81f.zip
mount.cifs: check access of credential files before opening
It's possible for an unprivileged user to pass a setuid mount.cifs a credential or password file to which he does not have access. This can cause mount.cifs to open the file on his behalf and possibly leak the info in the first few lines of the file. Check the access permissions of the file before opening it. Reported-by: Ronald Volgers <r.c.volgers@student.utwente.nl> Signed-off-by: Jeff Layton <jlayton@redhat.com> Acked-by: Steve French <sfrench@us.ibm.com>
-rw-r--r--client/mount.cifs.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/client/mount.cifs.c b/client/mount.cifs.c
index 1c04e13c8d..0f41afff9c 100644
--- a/client/mount.cifs.c
+++ b/client/mount.cifs.c
@@ -320,6 +320,11 @@ static int open_cred_file(char * file_name)
char * temp_val;
FILE * fs;
int i, length;
+
+ i = access(file_name, R_OK);
+ if (i)
+ return i;
+
fs = fopen(file_name,"r");
if(fs == NULL)
return errno;
@@ -442,6 +447,12 @@ static int get_password_from_file(int file_descript, char * filename)
}
if(filename != NULL) {
+ rc = access(filename, R_OK);
+ if (rc) {
+ fprintf(stderr, "mount.cifs failed: access check of %s failed: %s\n",
+ filename, strerror(errno));
+ exit(EX_SYSERR);
+ }
file_descript = open(filename, O_RDONLY);
if(file_descript < 0) {
fprintf(stderr, "mount.cifs failed. %s attempting to open password file %s\n",