csu/check_fds.c

   1 /* Copyright (C) 2000-2024 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3
   4    The GNU C Library is free software; you can redistribute it and/or
   5    modify it under the terms of the GNU Lesser General Public
   6    License as published by the Free Software Foundation; either
   7    version 2.1 of the License, or (at your option) any later version.
   8
   9    The GNU C Library is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12    Lesser General Public License for more details.
  13
  14    You should have received a copy of the GNU Lesser General Public
  15    License along with the GNU C Library; if not, see
  16    <https://www.gnu.org/licenses/>.  */
  17
  18 #include <errno.h>
  19 #include <fcntl.h>
  20 #include <paths.h>
  21 #include <unistd.h>
  22 #include <sys/stat.h>
  23 #include <sys/sysmacros.h>
  24
  25 /* Try to get a machine dependent instruction which will make the
  26    program crash.  This is used in case everything else fails.  */
  27 #include <abort-instr.h>
  28 #ifndef ABORT_INSTRUCTION
  29 /* No such instruction is available.  */
  30 # define ABORT_INSTRUCTION
  31 #endif
  32
  33 #include <device-nrs.h>
  34 #include <not-cancel.h>
  35
  36
  37 /* Should other OSes (e.g., Hurd) have different versions which can
  38    be written in a better way?  */
  39 static void
  40 check_one_fd (int fd, int mode)
  41 {
  42   if (__builtin_expect (__fcntl64_nocancel (fd, F_GETFD), 0) == -1
  43       && errno == EBADF)
  44     {
  45       const char *name;
  46       dev_t dev;
  47
  48       /* For writable descriptors we use /dev/full.  */
  49       if ((mode & O_ACCMODE) == O_WRONLY)
  50         {
  51           name = _PATH_DEV "full";
  52           dev = __gnu_dev_makedev (DEV_FULL_MAJOR, DEV_FULL_MINOR);
  53         }
  54       else
  55         {
  56           name = _PATH_DEVNULL;
  57           dev = __gnu_dev_makedev (DEV_NULL_MAJOR, DEV_NULL_MINOR);
  58         }
  59
  60       /* Something is wrong with this descriptor, it's probably not
  61          opened.  Open /dev/null so that the SUID program we are
  62          about to start does not accidentally use this descriptor.  */
  63       int nullfd = __open_nocancel (name, mode, 0);
  64
  65       /* We are very paranoid here.  With all means we try to ensure
  66          that we are actually opening the /dev/null device and nothing
  67          else.
  68
  69          Note that the following code assumes that STDIN_FILENO,
  70          STDOUT_FILENO, STDERR_FILENO are the three lowest file
  71          descriptor numbers, in this order.  */
  72       struct __stat64_t64 st;
  73       if (__glibc_unlikely (nullfd != fd)
  74           || __glibc_likely (__fstat64_time64 (fd, &st) != 0)
  75           || __glibc_unlikely (S_ISCHR (st.st_mode) == 0)
  76           || st.st_rdev != dev)
  77         /* We cannot even give an error message here since it would
  78            run into the same problems.  */
  79         while (1)
  80           /* Try for ever and ever.  */
  81           ABORT_INSTRUCTION;
  82     }
  83 }
  84
  85
  86 void
  87 __libc_check_standard_fds (void)
  88 {
  89   /* Check all three standard file descriptors.  The O_NOFOLLOW flag
  90      is really paranoid but some people actually are.  If /dev/null
  91      should happen to be a symlink to somewhere else and not the
  92      device commonly known as "/dev/null" we bail out.  */
  93   check_one_fd (STDIN_FILENO, O_WRONLY | O_NOFOLLOW);
  94   check_one_fd (STDOUT_FILENO, O_RDONLY | O_NOFOLLOW);
  95   check_one_fd (STDERR_FILENO, O_RDONLY | O_NOFOLLOW);
  96 }