TOOLS: Use file descriptor to avoid races when creating a home directory

When creating a home directory, the destination tree can be modified in
various ways while it is being constructed because directory permissions
are set before populating the directory. This can lead to file creation
and permission changes outside the target directory tree, using hard links.

This security problem was assigned CVE-2013-0219

https://fedorahosted.org/sssd/ticket/1782

1 files changed, 1 insertions, 27 deletions

diff --git a/src/tools/tools_util.c b/src/tools/tools_util.c
index e87d8e8f0..c5f50e2cd 100644
--- a/src/tools/tools_util.c
+++ b/src/tools/tools_util.c
@@ -467,33 +467,7 @@ int create_homedir(const char *skeldir,
 
     selinux_file_context(homedir);
 
-    ret = mkdir(homedir, 0);
-    if (ret != 0) {
-        ret = errno;
-        DEBUG(1, ("Cannot create user's home directory: [%d][%s].\n",
-                  ret, strerror(ret)));
-        goto done;
-    }
-
-    ret = chown(homedir, uid, gid);
-    if (ret != 0) {
-        ret = errno;
-        DEBUG(1, ("Cannot chown user's home directory: [%d][%s].\n",
-                  ret, strerror(ret)));
-        goto done;
-    }
-
-    ret = chmod(homedir, 0777 & ~default_umask);
-    if (ret != 0) {
-        ret = errno;
-        DEBUG(1, ("Cannot chmod user's home directory: [%d][%s].\n",
-                  ret, strerror(ret)));
-        goto done;
-    }
-
-    reset_selinux_file_context();
-
-    ret = copy_tree(skeldir, homedir, uid, gid);
+    ret = copy_tree(skeldir, homedir, 0777 & ~default_umask, uid, gid);
     if (ret != EOK) {
         DEBUG(1, ("Cannot populate user's home directory: [%d][%s].\n",
                   ret, strerror(ret)));