coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-11 05:52:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

mkhtemp: use O_NOFOLLOW in same_dir

Browse Source 
we have a policy:
symlinks do not exist.

Signed-off-by: Leah Rowe <leah@libreboot.org>
This commit is contained in:
Leah Rowe
2026-03-28 09:16:05 +00:00
parent 93ecd26306
commit 16bc9feda8
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/libreboot-utils/lib/mkhtemp.c
+4 -2
View File
@@ -327,11 +327,11 @@ same_dir(const char *a, const char *b)
if (rval_scmp == 0)
goto success_same_dir;
fd_a = fs_open(a, O_RDONLY | O_DIRECTORY);
fd_a = fs_open(a, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
if (fd_a < 0)
goto err_same_dir;
fd_b = fs_open(b, O_RDONLY | O_DIRECTORY);
fd_b = fs_open(b, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
if (fd_b < 0)
goto err_same_dir;
@@ -906,6 +906,8 @@ int secure_file(int *fd,
if (lock_file(*fd, flags) == -1)
goto err_demons;
/* TODO: why would this be NULL? audit
* to find out. we should always verify! */
if (expected != NULL)
if (fd_verify_identity(*fd, expected, &st_now) < 0)
goto err_demons;