From 55c3816fba3707bcda54b1b0fb06eeb33da2cfdb Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Fri, 25 Sep 2009 06:51:01 -0400 Subject: [PATCH] mount.cifs: check access of credential files before opening It's possible for an unprivileged user to pass a setuid mount.cifs a credential or password file to which he does not have access. This can cause mount.cifs to open the file on his behalf and possibly leak the info in the first few lines of the file. Check the access permissions of the file before opening it. Reported-by: Ronald Volgers Signed-off-by: Jeff Layton Acked-by: Steve French --- source3/client/mount.cifs.c | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/source3/client/mount.cifs.c b/source3/client/mount.cifs.c index 0c551cc..54d59cf 100644 --- a/source3/client/mount.cifs.c +++ b/source3/client/mount.cifs.c @@ -198,6 +198,11 @@ static int open_cred_file(char * file_name) char * temp_val; FILE * fs; int i, length; + + i = access(file_name, R_OK); + if (i) + return i; + fs = fopen(file_name,"r"); if(fs == NULL) return errno; @@ -320,6 +325,12 @@ static int get_password_from_file(int file_descript, char * filename) } if(filename != NULL) { + rc = access(filename, R_OK); + if (rc) { + fprintf(stderr, "mount.cifs failed: access check of %s failed: %s\n", + filename, strerror(errno)); + exit(EX_SYSERR); + } file_descript = open(filename, O_RDONLY); if(file_descript < 0) { printf("mount.cifs failed. %s attempting to open password file %s\n", -- 1.6.0.6