Changeset 35403 in vbox for trunk/src/VBox/HostDrivers/Support

Timestamp:

Jan 5, 2011 11:23:09 AM (14 years ago)

Author:

vboxsync

Message:

supR3HardenedVerifyFsObject: Moved the type check up before the permission checks because symbolic links usually have a mode mask of 777 and would therefore trigger VERR_SUPLIB_WORLD_WRITABLE instead of VERR_SUPLIB_SYMLINKS_ARE_NOT_PERMITTED.

File:

• trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp (modified) (2 diffs)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp

@@ -1151 +1151 @@
 
     /*
+     * The object type must be directory or file, no symbolic links or other
+     * risky stuff (sorry dude, but we're paranoid on purpose here).
+     */
+    if (   !S_ISDIR(pFsObjState->Stat.st_mode)
+        && !S_ISREG(pFsObjState->Stat.st_mode))
+    {
+        if (S_ISLNK(pFsObjState->Stat.st_mode))
+            return supR3HardenedSetError3(VERR_SUPLIB_SYMLINKS_ARE_NOT_PERMITTED, pErrInfo,
+                                          "Symlinks are not permitted: '", pszPath, "'");
+        return supR3HardenedSetError3(VERR_SUPLIB_NOT_DIR_NOT_FILE, pErrInfo,
+                                      "Not regular file or directory: '", pszPath, "'");
+    }
+    if (fDir != !!S_ISDIR(pFsObjState->Stat.st_mode))
+    {
+        if (S_ISDIR(pFsObjState->Stat.st_mode))
+            return supR3HardenedSetError3(VERR_SUPLIB_IS_DIRECTORY, pErrInfo,
+                                          "Expected file but found directory: '", pszPath, "'");
+        return supR3HardenedSetError3(VERR_SUPLIB_IS_FILE, pErrInfo,
+                                      "Expected directory but found file: '", pszPath, "'");
+    }
+
+    /*
      * The group does not matter if it does not have write access, if it has
      * write access it must be group 0 (root/wheel/whatever).
@@ -1181 +1203 @@
      */
     /** @todo */
-
-    /*
-     * Check the object type.
-     */
-    if (   !S_ISDIR(pFsObjState->Stat.st_mode)
-        && !S_ISREG(pFsObjState->Stat.st_mode))
-    {
-        if (S_ISLNK(pFsObjState->Stat.st_mode))
-            return supR3HardenedSetError3(VERR_SUPLIB_SYMLINKS_ARE_NOT_PERMITTED, pErrInfo,
-                                          "Symlinks are not permitted: '", pszPath, "'");
-        return supR3HardenedSetError3(VERR_SUPLIB_NOT_DIR_NOT_FILE, pErrInfo,
-                                      "Not regular file or directory: '", pszPath, "'");
-    }
-    if (fDir != !!S_ISDIR(pFsObjState->Stat.st_mode))
-    {
-        if (S_ISDIR(pFsObjState->Stat.st_mode))
-            return supR3HardenedSetError3(VERR_SUPLIB_IS_DIRECTORY, pErrInfo,
-                                          "Expected file but found directory: '", pszPath, "'");
-        return supR3HardenedSetError3(VERR_SUPLIB_IS_FILE, pErrInfo,
-                                      "Expected directory but found file: '", pszPath, "'");
-    }
 
     return VINF_SUCCESS;