]>
Commit | Line | Data |
---|---|---|
581c785b | 1 | /* Copyright (C) 2000-2022 Free Software Foundation, Inc. |
b6ab06ce UD |
2 | This file is part of the GNU C Library. |
3 | ||
4 | The GNU C Library is free software; you can redistribute it and/or | |
5 | modify it under the terms of the GNU Lesser General Public | |
6 | License as published by the Free Software Foundation; either | |
7 | version 2.1 of the License, or (at your option) any later version. | |
8 | ||
9 | The GNU C Library is distributed in the hope that it will be useful, | |
10 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |
11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
12 | Lesser General Public License for more details. | |
13 | ||
14 | You should have received a copy of the GNU Lesser General Public | |
59ba27a6 | 15 | License along with the GNU C Library; if not, see |
5a82c748 | 16 | <https://www.gnu.org/licenses/>. */ |
b6ab06ce UD |
17 | |
18 | #include <errno.h> | |
19 | #include <fcntl.h> | |
20 | #include <paths.h> | |
21 | #include <unistd.h> | |
22 | #include <sys/stat.h> | |
23 | #include <sys/sysmacros.h> | |
24 | ||
25 | /* Try to get a machine dependent instruction which will make the | |
26 | program crash. This is used in case everything else fails. */ | |
27 | #include <abort-instr.h> | |
28 | #ifndef ABORT_INSTRUCTION | |
29 | /* No such instruction is available. */ | |
30 | # define ABORT_INSTRUCTION | |
31 | #endif | |
32 | ||
33 | #include <device-nrs.h> | |
34 | #include <not-cancel.h> | |
35 | ||
36 | ||
37 | /* Should other OSes (e.g., Hurd) have different versions which can | |
38 | be written in a better way? */ | |
39 | static void | |
40 | check_one_fd (int fd, int mode) | |
41 | { | |
06ab719d | 42 | if (__builtin_expect (__fcntl64_nocancel (fd, F_GETFD), 0) == -1 |
b6ab06ce UD |
43 | && errno == EBADF) |
44 | { | |
45 | const char *name; | |
46 | dev_t dev; | |
47 | ||
48 | /* For writable descriptors we use /dev/full. */ | |
49 | if ((mode & O_ACCMODE) == O_WRONLY) | |
50 | { | |
51 | name = _PATH_DEV "full"; | |
8b4a1182 | 52 | dev = __gnu_dev_makedev (DEV_FULL_MAJOR, DEV_FULL_MINOR); |
b6ab06ce UD |
53 | } |
54 | else | |
55 | { | |
56 | name = _PATH_DEVNULL; | |
8b4a1182 | 57 | dev = __gnu_dev_makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR); |
b6ab06ce UD |
58 | } |
59 | ||
60 | /* Something is wrong with this descriptor, it's probably not | |
61 | opened. Open /dev/null so that the SUID program we are | |
c0c3f78a | 62 | about to start does not accidentally use this descriptor. */ |
c2284574 | 63 | int nullfd = __open_nocancel (name, mode, 0); |
b6ab06ce UD |
64 | |
65 | /* We are very paranoid here. With all means we try to ensure | |
66 | that we are actually opening the /dev/null device and nothing | |
67 | else. | |
68 | ||
69 | Note that the following code assumes that STDIN_FILENO, | |
70 | STDOUT_FILENO, STDERR_FILENO are the three lowest file | |
71 | decsriptor numbers, in this order. */ | |
52a5fe70 AZ |
72 | struct __stat64_t64 st; |
73 | if (__glibc_unlikely (nullfd != fd) | |
74 | || __glibc_likely (__fstat64_time64 (fd, &st) != 0) | |
75 | || __glibc_unlikely (S_ISCHR (st.st_mode) == 0) | |
b6ab06ce UD |
76 | || st.st_rdev != dev) |
77 | /* We cannot even give an error message here since it would | |
78 | run into the same problems. */ | |
79 | while (1) | |
80 | /* Try for ever and ever. */ | |
81 | ABORT_INSTRUCTION; | |
82 | } | |
83 | } | |
84 | ||
85 | ||
86 | void | |
87 | __libc_check_standard_fds (void) | |
88 | { | |
a12ae89f FW |
89 | /* Check all three standard file descriptors. The O_NOFOLLOW flag |
90 | is really paranoid but some people actually are. If /dev/null | |
91 | should happen to be a symlink to somewhere else and not the | |
92 | device commonly known as "/dev/null" we bail out. */ | |
b6ab06ce UD |
93 | check_one_fd (STDIN_FILENO, O_WRONLY | O_NOFOLLOW); |
94 | check_one_fd (STDOUT_FILENO, O_RDONLY | O_NOFOLLOW); | |
95 | check_one_fd (STDERR_FILENO, O_RDONLY | O_NOFOLLOW); | |
96 | } |