Problem - Kevin Tafuro

opening a file that it shouldn’t, as shown in Figure 2-2. The problem is that the program
can manipulate either file, and it gets tricked into opening one on behalf of the
user that it shouldn’t have.
While such an attack might sound impossible to perform, attackers have many tricks
to slow down a program to make exploiting race conditions easier. Plus, even if an
attacker can only exploit the race condition every 1,000 times, generally the attack
can be automated.
The best approach is to actually have the program take on the identity of the unprivileged
user before opening the file. That way, the correct access permission checks
will happen automatically when the file is opened. You need not even call access( ).
After the file is opened, the program can revert to its privileged state. For example,
here’s some pseudo-code that opens a file properly, using the spc_drop_privileges( )
and spc_restore_privileges( ) functions from Recipe 1.3:
int fd;
Filesystem looks like this when
someone calls access() on the
symbolic link.
Figure 2-1. Stage 1 of a TOCTOU race condition: Time of Check
The attacker has changed the
symbolic link to point to a file
that he would otherwise not
have access to.
Figure 2-2. Stage 2 of a TOCTOU race condition: Time of Use
/* Temporarily drop drivileges */
spc_drop_privileges(0);
/* Open the file with the limited privileges */
fd = open("/some/file/that/needs/opening", O_RDWR);
/* Restore privileges */
spc_restore_privileges( );
/* Check the return value from open to see if the file was opened successfully. */
if (fd = = -1) {
perror("open(\"/some/file/that/needs/opening\")");
abort( );
}
44 | Chapter 2: Access Control
Symbolic
Link
Symbolic
Link
/etc/passwd
(attacker does not have
privileges to write)
/home/foo/bar
(attacker has
privileges to write)
/etc/passwd
(attacker does not have
privileges to write)
/home/foo/bar
(attacker has
privileges to write)
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.