vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sandbox: use sane access rights for files

Browse Source 
When writing an executable, allowing other users to modify it introduces
a security issue.

Generally we should avoid giving other users write access to our files by
default.

Replace chmod(777) by chmod(755) and chmod(644).

Fixes: 47f5fcfb41 ("sandbox: Add os_jump_to_image() to run another executable")
Fixes: d9165153ca ("sandbox: add flags for open() call")
Fixes: 5c2859cdc3 ("sandbox: Allow reading/writing of RAM buffer")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Sean Anderson <seanga2@gmail.com>
This commit is contained in:
Heinrich Schuchardt
2024-07-03 07:36:32 +01:00
committed by Simon Glass
parent 65fbdab272
commit d1fffbe3c8
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/sandbox/cpu/os.c
+3 -3
View File
@@ -109,7 +109,7 @@ int os_open(const char *pathname, int os_flags)
*/
flags |= O_CLOEXEC;
return open(pathname, flags, 0777);
return open(pathname, flags, 0644);
}
int os_close(int fd)
@@ -746,7 +746,7 @@ int os_write_ram_buf(const char *fname)
struct sandbox_state *state = state_get_current();
int fd, ret;
fd = open(fname, O_CREAT | O_WRONLY, 0777);
fd = open(fname, O_CREAT | O_WRONLY, 0644);
if (fd < 0)
return -ENOENT;
ret = write(fd, state->ram_buf, state->ram_size);
@@ -791,7 +791,7 @@ static int make_exec(char *fname, const void *data, int size)
if (write(fd, data, size) < 0)
return -EIO;
close(fd);
if (chmod(fname, 0777))
if (chmod(fname, 0755))
return -ENOEXEC;
return 0;