util: never follow symlinks in rm_rf_children()
The function checks if the entry is a directory before recursing, but there is a window between the check and the open, during which the directory could be replaced with a symlink. CVE-2012-1174 https://bugzilla.redhat.com/show_bug.cgi?id=803358
This commit is contained in:
parent
16f1239e1e
commit
5ebff53375
|
@ -3593,7 +3593,8 @@ static int rm_rf_children(int fd, bool only_dirs, bool honour_sticky) {
|
|||
if (is_dir) {
|
||||
int subdir_fd;
|
||||
|
||||
if ((subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC)) < 0) {
|
||||
subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
|
||||
if (subdir_fd < 0) {
|
||||
if (ret == 0 && errno != ENOENT)
|
||||
ret = -errno;
|
||||
continue;
|
||||
|
|
Loading…
Reference in a new issue