Problem - Kevin Tafuro

directory /home/myhome/stuff/securestuff. If the directory /home/myhome/stuff is writable
by another user, that user could rename the directory securestuff to something
else. The result would be that your program would no longer be able to find the file
containing its sensitive data.
Even if the securestuff directory is owned by the user who owns the file containing
the sensitive data, and the permissions on the directory prevent other users from
writing to it, the permissions that matter are on the parent directory, /home/myhome/
stuff. This same problem exists for every directory in the path, right up to the root
directory.
In this recipe we present a function, spc_is_safedir( ), for checking all of the directories
in a path specification on Unix. It traverses the directory tree from the bottom
back up to the root, ensuring that only the owner or superuser have write access to
each directory.
The spc_is_safedir( ) function requires a single argument specifying the directory to
check. The return value from the function is –1 if some kind of error occurs while
attempting to verify the safety of the path specification, 0 if the path specification is
not safe, or 1 if the path specification is safe.
46 | Chapter 2: Access Control
On Unix systems, a process has only one current directory; all threads
within a process share the same working directory. The code presented
here changes the working directory as it works; therefore, the
code is not thread-safe!
#include
#include
#include
#include
#include
#include
#include
#include
int spc_is_safedir(const char *dir) {
DIR *fd, *start;
int rc = -1;
char new_dir[PATH_MAX + 1];
uid_t uid;
struct stat f, l;
if (!(start = opendir("."))) return -1;
if (lstat(dir, &l) = = -1) {
closedir(start);
return -1;
}
uid = geteuid( );
do {
if (chdir(dir) = = -1) break;
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.