-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chown+chgrp+chmod: Fix handling of preserve root flag and error messages #6042
Conversation
GNU testsuite comparison:
|
4bc6b83
to
956cf69
Compare
Changes since last push:
|
GNU testsuite comparison:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Alright, please check that I understand correctly. Here's what I got from this:
We need to know whether symlinks will be dereferenced on the path to know how to check for root. Dereferencing happens if either the setting for dereferencing is passed or if the /
is at the end, so that we need to enter the directory and to do that need to dereference.
Does that make sense? If so, could you add that last part in a comment somewhere. It took me a while to understand :)
I also wonder if these path checks are the right way to do it. Maybe there's some other way to check this? It all feels inherently finnicky.
One of the GNU tests checks for the exact error message.
956cf69
to
31e6fa7
Compare
Changes since last push:
|
Nope, wait, I got something wrong with the quoting. |
…message This is explicitly tested in the GNU tests.
This function is by necessity ill-defined: Depending on the context, '..' is either the logical parent directory, sometimes the physical parent directory. This function can only work for the latter case, in which case `Path::canonicalize` is often a better approach.
31e6fa7
to
d25d994
Compare
Changes since last push:
|
GNU testsuite comparison:
|
well done :) |
This makes the GNU
preserve-root.log
test green.In particular:
Path::is_dir()
completely ignores whether a given argument has a trailing slash or not, but that is the criterion that GNU (and many other tools) apparently uses to decide whether the path points "at" or "into" a directory. (See below for demonstration.)chmod
simply forgot to output its own name in one place.Additional notes:
resolve_relative_path
superfluous. This function is by necessity ill-defined: Depending on the context,..
is either the logical parent directory, sometimes the physical parent directory. This function can only work for the latter case, in which casePath::canonicalize
is often a better approach.chown -R -L
and the attacker can quickly inject a directory and replace it with a symlink to/
, then--preserve-root
does not trigger. However, in this scenario the attacker could probably just as well create a handful of symlinks, one for each directory in/
, for the same effect. So this is not a vulnerability, just an unavoidable bug.)Path::is_dir
demoproduces