Changeset 13788 in vbox for trunk/src/libs/xpcom18a4/ipc/ipcd/daemon

Timestamp:

Nov 4, 2008 3:22:30 PM (16 years ago)

Author:

vboxsync

Message:

added (still disabled) code for additional security checks in /tmp/.vbox-*-ipc

File:

• trunk/src/libs/xpcom18a4/ipc/ipcd/daemon/src/ipcdUnix.cpp (modified) (4 diffs)

trunk/src/libs/xpcom18a4/ipc/ipcd/daemon/src/ipcdUnix.cpp

@@ -94 +94 @@
     ELockFileOpen = -1,
     ELockFileLock = -2,
-
+    ELockFileOwner = -3,
 };
 
@@ -113 +113 @@
     memcpy(lockFile + dirLen + 1, lockName, sizeof(lockName));
 
+#if 0
+#ifdef VBOX
+    //
+    // Security checks
+    //
+    struct stat st;
+    if (stat(baseDir, &st) == -1)
+    {
+        printf("Cannot stat '%s'.\n", baseDir);
+        return ELockFileOwner;
+    }
+
+    if (st.st_uid != getuid() && st.st_uid != geteuid())
+    {
+        printf("Wrong owner (%d) of '%s'.\n", st.st_uid, baseDir);
+        return ELockFileOwner;
+    }
+
+    if (st.st_mode != (__S_IREAD | __S_IWRITE | __S_IEXEC | __S_IFDIR))
+    {
+        printf("Wrong mode (%o) of '%s'.\n", st.st_mode, baseDir);
+        return ELockFileOwner;
+    }
+#endif
+#endif
+
     //
     // open lock file.  it remains open until we shutdown.
@@ -118 +144 @@
     ipcLockFD = open(lockFile, O_WRONLY|O_CREAT, S_IWUSR|S_IRUSR);
 
+#if 0
+#ifndef VBOX
     free(lockFile);
+#endif
+#endif
 
     if (ipcLockFD == -1)
         return ELockFileOpen;
+
+#if 0
+#ifdef VBOX
+    //
+    // Security checks
+    //
+    if (fstat(ipcLockFD, &st) == -1)
+    {
+        printf("Cannot stat '%s'.\n", lockFile);
+        free(lockFile);
+        return ELockFileOwner;
+    }
+
+    if (st.st_uid != getuid() && st.st_uid != geteuid())
+    {
+        printf("Wrong owner (%d) of '%s'.\n", st.st_uid, lockFile);
+        free(lockFile);
+        return ELockFileOwner;
+    }
+
+    if (st.st_mode != (__S_IREAD | __S_IWRITE | __S_IFREG))
+    {
+        printf("Wrong mode (%o) of '%s'.\n", st.st_mode, lockFile);
+        free(lockFile);
+        return ELockFileOwner;
+    }
+
+    free(lockFile);
+#endif
+#endif
 
     //
@@ -434 +494 @@
             // we terminate
 #ifdef VBOX
-            printf("Cannot create a lock file for '%s'.\n"
-                   "Check permissions.\n", addr.local.path);
+            if (status != ELockFileOwner)
+                printf("Cannot create a lock file for '%s'.\n"
+                        "Check permissions.\n", addr.local.path);
 #endif
             return 0;