Fix CVE-2011-4029: File permission change vulnerability.
Use fchmod() to change permissions of the lock file instead
of chmod(), thus avoid the race that can be exploited to set
a symbolic link to any file or directory in the system.
Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b67581cf82
)
This commit is contained in:
parent
f80d233578
commit
12f65819ff
|
@ -295,7 +295,7 @@ LockServer(void)
|
|||
FatalError("Could not create lock file in %s\n", tmp);
|
||||
(void) sprintf(pid_str, "%10ld\n", (long)getpid());
|
||||
(void) write(lfd, pid_str, 11);
|
||||
(void) chmod(tmp, 0444);
|
||||
(void) fchmod(lfd, 0444);
|
||||
(void) close(lfd);
|
||||
|
||||
/*
|
||||
|
|
Loading…
Reference in New Issue