Problem - Kevin Tafuro

efore creating the file or to use fchmod( ) to change the permissions after the file is
created.
In most cases, you’ll be attempting to loosen restrictions, but consider what happens
when fopen( ) is used to create a new file. The fopen( ) function provides no way to
specify the permissions to use for the new file, and it always uses 0666, which grants
read and write access to the owning user, the owning group, and everyone else.
Again, the only way to modify this behavior is either to set the umask before calling
fopen( ) or to use fchmod( ) after the file is created.
Using fchmod( ) to change the permissions of a file after it is created is not a good
idea because it introduces a race condition. Between the time the file is created and
the time the permissions are modified, an attacker could possibly gain unauthorized
access to the file. The proper solution is therefore to modify the umask before creating
the file.
Properly using umasks in your program can be a bit complicated, but here are some
general guidelines:
• If you are creating files that contain sensitive data, always create them readable
and writable by only the file owner, and deny access to group members and all
other users.
• Be aware that files that do not contain sensitive data may be readable by other
users on the system. If the user wants to stop this behavior, the umask can be set
appropriately before starting your program.
• Avoid setting execute permissions on files, especially group and world execute. If
your program generates files that are meant to be executable, set the execute bit
only for the file owner.
• Create directories that may contain files used to store sensitive information such
that only the owner of the directory has read, write, and execute permissions for
the directory. This allows only the owner of the directory to enter the directory
or view or change its contents, but no other users can view or otherwise access
the directory. (See the discussion of secure directories in Recipe 2.4 for more
information on the importance of this requirement.)
• Create directories that are not intended to store sensitive files such that the
owner has read, write, and execute permissions, while group members and
everyone else has only read and execute permissions. If the user wants to stop
this behavior, the umask can be set appropriately before starting your program.
• Do not rely on setting the umask to a “secure” value once at the beginning of the
program and then calling all file or directory creation functions with overly permissive
file modes. Explicitly set the mode of the file at the point of creation.
There are two reasons to do this. First, it makes the code clear; your intent concerning
permissions is obvious. Second, if an attacker managed to somehow
56 | Chapter 2: Access Control
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.