From cbe3dd9930e68140ca8aeb17e4fb20fce09981df Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Mon, 14 Mar 2011 17:41:12 +0100 Subject: abrtd: do not accept requests to delete directories not in /var/spool/abrt/ Signed-off-by: Denys Vlasenko --- src/daemon/MiddleWare.cpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'src/daemon') diff --git a/src/daemon/MiddleWare.cpp b/src/daemon/MiddleWare.cpp index 8d62c697..84400361 100644 --- a/src/daemon/MiddleWare.cpp +++ b/src/daemon/MiddleWare.cpp @@ -744,6 +744,16 @@ int CreateReportThread(const char* crash_id, long caller_uid, int force, const c /* Remove dump dir */ int DeleteDebugDump(const char *dump_dir_name, long caller_uid) { + /* If doesn't start with "DEBUG_DUMPS_DIR/"... */ + if (strncmp(dump_dir_name, DEBUG_DUMPS_DIR"/", strlen(DEBUG_DUMPS_DIR"/")) != 0 + /* or contains "/." anywhere (-> might contain ".." component) */ + || strstr(dump_dir_name + strlen(DEBUG_DUMPS_DIR), "/.") + ) { + /* Then refuse to operate on it (someone is attacking us??) */ + error_msg("Bad dump directory name '%s', not deleting", dump_dir_name); + return MW_ERROR; + } + struct dump_dir *dd = dd_opendir(dump_dir_name, /*flags:*/ 0); if (!dd) return MW_NOENT_ERROR; @@ -760,7 +770,7 @@ int DeleteDebugDump(const char *dump_dir_name, long caller_uid) if (!string_to_bool(inform_all)) { dd_close(dd); - error_msg("crash '%s' can't be accessed by user with uid %ld", dump_dir_name, caller_uid); + error_msg("Dump directory '%s' can't be accessed by user with uid %ld", dump_dir_name, caller_uid); return 1; } } -- cgit