Problem - Kevin Tafuro

The potential for security vulnerabilities arising from file descriptors being managed
improperly is high in non-setuid programs. For setuid (especially setuid root) programs,
the potential for problems increases dramatically. The problem is so serious
that some variants of Unix (OpenBSD, in particular) will explicitly open stdin,
stdout, and stderr from the execve( ) system call for a setuid process if they’re not
already open.
The following function, spc_sanitize_files( ), first closes all open file descriptors
that are not one of the standard descriptors. Because there is no easy way to tell
whether a descriptor is open, close( ) is called for each one, and any error returned is
ignored. Once all of the nonstandard descriptors are closed, stdin, stdout, and
stderr are checked to ensure that they are open. If any one of them is not open, an
attempt is made to open /dev/null. If/dev/null cannot be opened, the program is terminated
immediately.
#include
#include
#include
#include
#include
#include
#include
#ifndef OPEN_MAX
#define OPEN_MAX 256
#endif
static int open_devnull(int fd) {
FILE *f = 0;
if (!fd) f = freopen(_PATH_DEVNULL, "rb", stdin);
else if (fd = = 1) f = freopen(_PATH_DEVNULL, "wb", stdout);
else if (fd = = 2) f = freopen(_PATH_DEVNULL, "wb", stderr);
return (f && fileno(f) = = fd);
}
void spc_sanitize_files(void) {
int fd, fds;
struct stat st;
/* Make sure all open descriptors other than the standard ones are closed */
if ((fds = getdtablesize( )) = = -1) fds = OPEN_MAX;
for (fd = 3; fd < fds; fd++) close(fd);
/* Verify that the standard descriptors are open. If they're not, attempt to
* open them using /dev/null. If any are unsuccessful, abort.
*/
for (fd = 0; fd < 3; fd++)
if (fstat(fd, &st) = = -1 && (errno != EBADF || !open_devnull(fd))) abort( );
}
Managing File Descriptors Safely | 25
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.