From: Stefan Hajnoczi <stefanha@redhat.com>
To: qemu-devel@nongnu.org
Cc: Laurent Vivier <lvivier@redhat.com>,
Kevin Wolf <kwolf@redhat.com>, Thomas Huth <thuth@redhat.com>,
qemu-block@nongnu.org, Coiby Xu <Coiby.Xu@gmail.com>,
Gerd Hoffmann <kraxel@redhat.com>,
Stefan Hajnoczi <stefanha@redhat.com>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: [PATCH 2/3] vhost-user-blk-test: fix Coverity mkstemp(2) umask warning
Date: Wed, 26 May 2021 10:12:47 +0100 [thread overview]
Message-ID: <20210526091248.434459-3-stefanha@redhat.com> (raw)
In-Reply-To: <20210526091248.434459-1-stefanha@redhat.com>
The Linux man page for mkstemp(3) states:
In glibc versions 2.06 and earlier, the file is created with
permissions 0666, that is, read and write for all users. This old
behavior may be a security risk, especially since other UNIX flavors
use 0600, and somebody might overlook this detail when porting
programs. POSIX.1-2008 adds a requirement that the file be created
with mode 0600.
More generally, the POSIX specification of mkstemp() does not say
anything about file modes, so the application should make sure its
file mode creation mask (see umask(2)) is set appropriately before
calling mkstemp() (and mkostemp()).
glibc 2.0.6 was released in 1997 and POSIX caught up in 2008. macOS and
FreeBSD also use POSIX-compliant 0600 permissions.
At this point the Coverity warning seems archaic and no longer useful,
but go ahead and silence it.
*** CID 1453267: Security best practices violations (SECURE_TEMP)
/qemu/tests/qtest/vhost-user-blk-test.c: 827 in create_listen_socket()
821 {
822 int tmp_fd;
823 char *path;
824
825 /* No race because our pid makes the path unique */
826 path = g_strdup_printf("/tmp/qtest-%d-sock.XXXXXX", getpid());
>>> CID 1453267: Security best practices violations (SECURE_TEMP)
>>> Calling "mkstemp" without securely setting umask first.
827 tmp_fd = mkstemp(path);
828 g_assert_cmpint(tmp_fd, >=, 0);
829 close(tmp_fd);
830 unlink(path);
831
832 *fd = qtest_socket_server(path);
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
tests/qtest/vhost-user-blk-test.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/tests/qtest/vhost-user-blk-test.c b/tests/qtest/vhost-user-blk-test.c
index 581e283a03..412e010db8 100644
--- a/tests/qtest/vhost-user-blk-test.c
+++ b/tests/qtest/vhost-user-blk-test.c
@@ -803,11 +803,16 @@ static void destroy_file(void *path)
static char *drive_create(void)
{
int fd, ret;
+ mode_t old_umask;
/** vhost-user-blk won't recognize drive located in /tmp */
char *t_path = g_strdup("qtest.XXXXXX");
/** Create a temporary raw image */
+ old_umask = umask(S_IXUSR |
+ S_IRGRP | S_IWGRP | S_IXGRP |
+ S_IROTH | S_IWOTH | S_IXOTH);
fd = mkstemp(t_path);
+ umask(old_umask);
g_assert_cmpint(fd, >=, 0);
ret = ftruncate(fd, TEST_IMAGE_SIZE);
g_assert_cmpint(ret, ==, 0);
@@ -821,10 +826,15 @@ static char *create_listen_socket(int *fd)
{
int tmp_fd;
char *path;
+ mode_t old_umask;
/* No race because our pid makes the path unique */
path = g_strdup_printf("/tmp/qtest-%d-sock.XXXXXX", getpid());
+ old_umask = umask(S_IXUSR |
+ S_IRGRP | S_IWGRP | S_IXGRP |
+ S_IROTH | S_IWOTH | S_IXOTH);
tmp_fd = mkstemp(path);
+ umask(old_umask);
g_assert_cmpint(tmp_fd, >=, 0);
close(tmp_fd);
unlink(path);
--
2.31.1
next prev parent reply other threads:[~2021-05-26 9:14 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-26 9:12 [PATCH 0/3] vhost-user-blk-test and vdagent Coverity fixes Stefan Hajnoczi
2021-05-26 9:12 ` [PATCH 1/3] vhost-user-blk-test: fix Coverity open(2) false positives Stefan Hajnoczi
2021-05-30 19:05 ` Peter Maydell
2021-06-01 15:36 ` Stefan Hajnoczi
2021-05-26 9:12 ` Stefan Hajnoczi [this message]
2021-05-30 19:01 ` [PATCH 2/3] vhost-user-blk-test: fix Coverity mkstemp(2) umask warning Peter Maydell
2021-06-01 15:36 ` Stefan Hajnoczi
2021-05-26 9:12 ` [PATCH 3/3] ui/vdagent: fix clipboard info memory leak in error path Stefan Hajnoczi
2021-05-28 7:06 ` Gerd Hoffmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210526091248.434459-3-stefanha@redhat.com \
--to=stefanha@redhat.com \
--cc=Coiby.Xu@gmail.com \
--cc=kraxel@redhat.com \
--cc=kwolf@redhat.com \
--cc=lvivier@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.