Branch
Hash :
162ce0b7
Author :
Date :
2025-09-21T07:55:00
fchownat: fix security races and other bugs This fixes some unlikely security races, where our “no-op” chmod undid some other process’s chmod. Ironically this bug occurred on OpenBSD, our most paranoid target. This patch also fixes some EOVERFLOW bugs, along with a performance bug and a CHOWN_CHANGE_TIME_BUG with fchownat. * lib/chown.c, lib/fchownat.c, lib/lchown.c: Remove unnecessary inconsistencies. Include stat-time.h. (CHOWN_CHANGE_TIME_BUG, CHOWN_FAILS_TO_HONOR_ID_OF_NEGATIVE_ONE) (CHOWN_MODIFIES_SYMLINK, CHOWN_TRAILING_SLASH_BUG): Default to 0, and prefer ‘if (...)’ to ‘#ifdef ...’. (utimensat) [!HAVE_UTIMENSAT]: Default to a no-op. (rpl_chown, rpl_fchownat, rpl_lchown): Prefer ‘if (...)’ to ‘#ifdef ...’. Statically, call the stat-like and chown-like functions just once. Do not fail if the stat-like function fails with EOVERFLOW, if existence is all we care about. Use utimensat to update ctime, instead of a chmod-like function. * lib/fchownat.c (rpl_fchownat): Defend against OpenBSD’s CHOWN_CHANGE_TIME_BUG. This bug in rpl_fchownat was exposed by yesterday’s fix that caused rpl_fchownat to call fchownat instead of using the tricky old fork/chdir business. * m4/chown.m4 (gl_FUNC_CHOWN): Check for utimensat if the ctime bug is present. * modules/chown, modules/lchown, modules/fchownat: (Depends-on): Add stat-time.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
Description:
chown() function: change ownership of a file, following symlinks.
Files:
lib/chown.c
lib/fchown-stub.c
m4/chown.m4
Depends-on:
unistd-h
bool [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
fstat [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
issymlink [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
open [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
stat [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
stat-time [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
sys_stat-h [test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1]
configure.ac:
gl_FUNC_CHOWN
gl_CONDITIONAL([GL_COND_OBJ_CHOWN],
[test $HAVE_CHOWN = 0 || test $REPLACE_CHOWN = 1])
gl_CONDITIONAL([GL_COND_OBJ_FCHOWN_STUB],
[test $REPLACE_CHOWN = 1 && test $ac_cv_func_fchown = no])
gl_UNISTD_MODULE_INDICATOR([chown])
Makefile.am:
if GL_COND_OBJ_CHOWN
lib_SOURCES += chown.c
endif
if GL_COND_OBJ_FCHOWN_STUB
lib_SOURCES += fchown-stub.c
endif
Include:
<unistd.h>
License:
LGPLv2+
Maintainer:
Jim Meyering