From 076574744c20de3296e8f9f9e0f7ef946a78a431 Mon Sep 17 00:00:00 2001 From: Mark Johnston Date: Mon, 29 Jul 2019 19:02:16 +0000 Subject: [PATCH] Add mkostempsat(3). This is a variant of mkostemps() which takes a directory descriptor and returns a descriptor for a tempfile relative to that directory. Unlike the other mktemp functions, mkostempsat() can be used in capability mode. Reviewed by: cem Discussed with: brooks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D21031 --- include/stdlib.h | 1 + lib/libc/stdio/Makefile.inc | 2 +- lib/libc/stdio/Symbol.map | 4 ++++ lib/libc/stdio/mktemp.3 | 35 +++++++++++++++++++++++++++++------ lib/libc/stdio/mktemp.c | 32 ++++++++++++++++++++------------ 5 files changed, 55 insertions(+), 19 deletions(-) diff --git a/include/stdlib.h b/include/stdlib.h index b2264784ed80..0289980d17f0 100644 --- a/include/stdlib.h +++ b/include/stdlib.h @@ -297,6 +297,7 @@ int mergesort_b(void *, size_t, size_t, int (^)(const void *, const void *)); #endif int mkostemp(char *, int); int mkostemps(char *, int, int); +int mkostempsat(int, char *, int, int); void qsort_r(void *, size_t, size_t, void *, int (*)(void *, const void *, const void *)); int radixsort(const unsigned char **, int, const unsigned char *, diff --git a/lib/libc/stdio/Makefile.inc b/lib/libc/stdio/Makefile.inc index c029a67f17d4..59b8dd836685 100644 --- a/lib/libc/stdio/Makefile.inc +++ b/lib/libc/stdio/Makefile.inc @@ -63,7 +63,7 @@ MLINKS+=getc.3 fgetc.3 getc.3 getc_unlocked.3 getc.3 getchar.3 \ MLINKS+=getline.3 getdelim.3 MLINKS+=getwc.3 fgetwc.3 getwc.3 getwchar.3 MLINKS+=mktemp.3 mkdtemp.3 mktemp.3 mkstemp.3 mktemp.3 mkstemps.3 \ - mktemp.3 mkostemp.3 mktemp.3 mkostemps.3 + mktemp.3 mkostemp.3 mktemp.3 mkostemps.3 mktemp.3 mkostempsat.3 MLINKS+=open_memstream.3 open_wmemstream.3 MLINKS+=printf.3 asprintf.3 printf.3 dprintf.3 printf.3 fprintf.3 \ printf.3 snprintf.3 printf.3 sprintf.3 \ diff --git a/lib/libc/stdio/Symbol.map b/lib/libc/stdio/Symbol.map index 1194f1ca2697..afde0b1ff6a4 100644 --- a/lib/libc/stdio/Symbol.map +++ b/lib/libc/stdio/Symbol.map @@ -171,6 +171,10 @@ FBSD_1.5 { gets_s; }; +FBSD_1.6 { + mkostempsat; +}; + FBSDprivate_1.0 { _flockfile; _flockfile_debug_stub; diff --git a/lib/libc/stdio/mktemp.3 b/lib/libc/stdio/mktemp.3 index e6e9838ec7ec..b6a38f23d2e9 100644 --- a/lib/libc/stdio/mktemp.3 +++ b/lib/libc/stdio/mktemp.3 @@ -28,7 +28,7 @@ .\" @(#)mktemp.3 8.1 (Berkeley) 6/4/93 .\" $FreeBSD$ .\" -.Dd August 8, 2013 +.Dd July 29, 2019 .Dt MKTEMP 3 .Os .Sh NAME @@ -46,6 +46,8 @@ .Fn mkostemp "char *template" "int oflags" .Ft int .Fn mkostemps "char *template" "int suffixlen" "int oflags" +.Ft int +.Fn mkostempsat "int dfd" "char *template" "int suffixlen" "int oflags" .Ft char * .Fn mkdtemp "char *template" .In unistd.h @@ -126,6 +128,21 @@ function are told the length of the suffix string. .Pp The +.Fn mkostempsat +function acts the same as +.Fn mkostemps +but takes an additional directory descriptor as a parameter. +The temporary file is created relative to the corresponding +directory, or to the current working directory if the special +value +.Dv AT_FDCWD +is specified. +If the template path is an absolute path, the +.Fa dfd +parameter is ignored and the behavior is identical to +.Fn mkostemps . +.Pp +The .Fn mkdtemp function makes the same replacement to the template as in .Fn mktemp @@ -262,9 +279,10 @@ and is not specified by .St -p1003.1-2008 . The .Fn mkostemp , -.Fn mkstemps -and +.Fn mkstemps , .Fn mkostemps +and +.Fn mkostempsat functions do not conform to any standard. .Sh HISTORY A @@ -293,6 +311,10 @@ and .Fn mkostemps functions appeared in .Fx 10.0 . +The +.Fn mkostempsat +function appeared in +.Fx 13.0 . .Sh BUGS This family of functions produces filenames which can be guessed, though the risk is minimized when large numbers of @@ -308,10 +330,11 @@ and opening it for use (later in the user application) particularly dangerous from a security perspective. Whenever it is possible, -.Fn mkstemp -or +.Fn mkstemp , .Fn mkostemp -should be used instead, since it does not have the race condition. +or +.Fn mkostempsat +should be used instead, since they do not have the race condition. If .Fn mkstemp cannot be used, the filename created by diff --git a/lib/libc/stdio/mktemp.c b/lib/libc/stdio/mktemp.c index 0cc7496b693e..f08d92cc3ec7 100644 --- a/lib/libc/stdio/mktemp.c +++ b/lib/libc/stdio/mktemp.c @@ -49,17 +49,25 @@ __FBSDID("$FreeBSD$"); char *_mktemp(char *); -static int _gettemp(char *, int *, int, int, int); +static int _gettemp(int, char *, int *, int, int, int); static const unsigned char padchar[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; +int +mkostempsat(int dfd, char *path, int slen, int oflags) +{ + int fd; + + return (_gettemp(dfd, path, &fd, 0, slen, oflags) ? fd : -1); +} + int mkostemps(char *path, int slen, int oflags) { int fd; - return (_gettemp(path, &fd, 0, slen, oflags) ? fd : -1); + return (_gettemp(AT_FDCWD, path, &fd, 0, slen, oflags) ? fd : -1); } int @@ -67,7 +75,7 @@ mkstemps(char *path, int slen) { int fd; - return (_gettemp(path, &fd, 0, slen, 0) ? fd : -1); + return (_gettemp(AT_FDCWD, path, &fd, 0, slen, 0) ? fd : -1); } int @@ -75,7 +83,7 @@ mkostemp(char *path, int oflags) { int fd; - return (_gettemp(path, &fd, 0, 0, oflags) ? fd : -1); + return (_gettemp(AT_FDCWD, path, &fd, 0, 0, oflags) ? fd : -1); } int @@ -83,19 +91,19 @@ mkstemp(char *path) { int fd; - return (_gettemp(path, &fd, 0, 0, 0) ? fd : -1); + return (_gettemp(AT_FDCWD, path, &fd, 0, 0, 0) ? fd : -1); } char * mkdtemp(char *path) { - return (_gettemp(path, (int *)NULL, 1, 0, 0) ? path : (char *)NULL); + return (_gettemp(AT_FDCWD, path, (int *)NULL, 1, 0, 0) ? path : (char *)NULL); } char * _mktemp(char *path) { - return (_gettemp(path, (int *)NULL, 0, 0, 0) ? path : (char *)NULL); + return (_gettemp(AT_FDCWD, path, (int *)NULL, 0, 0, 0) ? path : (char *)NULL); } __warn_references(mktemp, @@ -108,7 +116,7 @@ mktemp(char *path) } static int -_gettemp(char *path, int *doopen, int domkdir, int slen, int oflags) +_gettemp(int dfd, char *path, int *doopen, int domkdir, int slen, int oflags) { char *start, *trv, *suffp, *carryp; char *pad; @@ -155,7 +163,7 @@ _gettemp(char *path, int *doopen, int domkdir, int slen, int oflags) for (; trv > path; --trv) { if (*trv == '/') { *trv = '\0'; - rval = stat(path, &sbuf); + rval = fstatat(dfd, path, &sbuf, 0); *trv = '/'; if (rval != 0) return (0); @@ -168,11 +176,11 @@ _gettemp(char *path, int *doopen, int domkdir, int slen, int oflags) } } + oflags |= O_CREAT | O_EXCL | O_RDWR; for (;;) { if (doopen) { - if ((*doopen = - _open(path, O_CREAT|O_EXCL|O_RDWR|oflags, 0600)) >= - 0) + *doopen = _openat(dfd, path, oflags, 0600); + if (*doopen >= 0) return (1); if (errno != EEXIST) return (0);