Commit 630e4c93 authored by Matthieu Herrb's avatar Matthieu Herrb Committed by Julien Cristau
Browse files

Fix CVE-2011-4029: File permission change vulnerability.



Use fchmod() to change permissions of the lock file instead
of chmod(), thus avoid the race that can be exploited to set
a symbolic link to any file or directory in the system.

Signed-off-by: default avatarMatthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b67581cf)
parent 4185af73
......@@ -315,7 +315,7 @@ LockServer(void)
FatalError("Could not create lock file in %s\n", tmp);
(void) sprintf(pid_str, "%10ld\n", (long)getpid());
(void) write(lfd, pid_str, 11);
(void) chmod(tmp, 0444);
(void) fchmod(lfd, 0444);
(void) close(lfd);
/*
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment