Problem - Kevin Tafuro

and avoiding having an attacker place untrusted files on special hardcoded file
descriptors.
Solution
On Unix, use the function getdtablesize( ) to obtain the size of the process’s file
descriptor table. For each file descriptor in the process’s table, close the descriptors
that are not stdin, stdout, orstderr, which are always 0, 1, and 2, respectively. Test
stdin, stdout, and stderr to ensure that they’re open using fstat( ) for each descriptor.
If any one is not open, open /dev/null and associate with the descriptor. If the
program is running setuid, stdin, stdout, and stderr should also be closed if they’re
not associated with a tty, and reopened using /dev/null.
On Windows, there is no way to determine what file handles are open, but the same
issue with open descriptors does not exist on Windows as it does on Unix.
Discussion
Normally, when a process is started, it inherits all open file descriptors from its parent.
This can be a problem because the size of the file descriptor table on Unix is typically
a fixed size. The parent process could therefore fill the file descriptor table with
bogus files to deny your program any file handles for opening its own files. The result
is essentially a denial of service for your program.
When a new file is opened, a descriptor is assigned using the first available entry in
the process’s file descriptor table. If stdin is not open, for example, the first file
opened is assigned a file descriptor of 0, which is normally reserved for stdin. Similarly,
if stdout is not open, file descriptor 1 is assigned next, followed by stderr’s file
descriptor of 2 if it is not open.
The only file descriptors that should remain open when your program starts are the
stdin, stdout, and stderr descriptors. If the standard descriptors are not open, your
program should open them using /dev/null and leave them open. Otherwise, calls to
functions like printf( ) can have unexpected and potentially disastrous effects.
Worse, the standard C library considers the standard descriptors to be special, and
some functions expect stderr to be properly opened for writing error messages to. If
your program opens a data file for writing and gets stderr’s file descriptor, an error
message written to stderr will destroy your data file.
24 | Chapter 1: Safe Initialization
Particularly in a chroot( ) environment (see Recipe 2.12), the /dev/null
device may not be available (it can be made available if the environment
is set up properly). If it is not available, the proper thing for your
program to do is to refuse to run.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.