diff options
| author | yamt <yamt@NetBSD.org> | 2002-08-10 09:32:19 +0000 |
|---|---|---|
| committer | yamt <yamt@NetBSD.org> | 2002-08-10 09:32:19 +0000 |
| commit | 5d8e52e7abe335256019b9bc1f2dfaa77f30e451 (patch) | |
| tree | 9ffb0fb7fcb08fa088236a4e576163e279970500 /lib/libc/stdio | |
| parent | 75c752933856ec1c8f5330eca491087f39a5f60f (diff) | |
bring in EXAMPLES and BUGS from openbsd.
Diffstat (limited to 'lib/libc/stdio')
| -rw-r--r-- | lib/libc/stdio/mktemp.3 | 119 |
1 files changed, 118 insertions, 1 deletions
diff --git a/lib/libc/stdio/mktemp.3 b/lib/libc/stdio/mktemp.3 index 5f4c951c60f..400f29e26ec 100644 --- a/lib/libc/stdio/mktemp.3 +++ b/lib/libc/stdio/mktemp.3 @@ -1,4 +1,4 @@ -.\" $NetBSD: mktemp.3,v 1.15 2002/02/07 07:00:26 ross Exp $ +.\" $NetBSD: mktemp.3,v 1.16 2002/08/10 09:32:19 yamt Exp $ .\" .\" Copyright (c) 1989, 1991, 1993 .\" The Regents of the University of California. All rights reserved. @@ -78,6 +78,10 @@ will result in .Fn mktemp testing roughly 26 ** 6 combinations. +At least 6 +.So Li X +.Sc Ns s +should be used, though 10 is much better. .Pp The .Fn mkstemp @@ -114,6 +118,85 @@ function returns \-1 if no suitable file could be created. If either call fails an error code is placed in the global variable .Va errno . +.Sh EXAMPLES +Quite often a programmer will want to replace a use of +.Fn mktemp +with +.Fn mkstemp , +usually to avoid the problems described above. +Doing this correctly requires a good understanding of the code in question. +.Pp +For instance, code of this form: +.Bd -literal -offset indent +char sfn[15] = ""; +FILE *sfp; + +strcpy(sfn, "/tmp/ed.XXXXXX"); +if (mktemp(sfn) == NULL || (sfp = fopen(sfn, "w+")) == NULL) { + fprintf(stderr, "%s: %s\en", sfn, strerror(errno)); + return (NULL); +} +return (sfp); +.Ed +.Pp +should be rewritten like this: +.Bd -literal -offset indent +char sfn[15] = ""; +FILE *sfp; +int fd = -1; + +strlcpy(sfn, "/tmp/ed.XXXXXX", sizeof sfn); +if ((fd = mkstemp(sfn)) == -1 || + (sfp = fdopen(fd, "w+")) == NULL) { + if (fd != -1) { + unlink(sfn); + close(fd); + } + fprintf(stderr, "%s: %s\en", sfn, strerror(errno)); + return (NULL); +} +return (sfp); +.Ed +.Pp +Often one will find code which uses +.Fn mktemp +very early on, perhaps to globally initialize the template nicely, but the +code which calls +.Xr open 2 +or +.Xr fopen 3 +on that filename will occur much later. +(In almost all cases, the use of +.Xr fopen 3 +will mean that the flags +.Dv O_CREAT +| +.Dv O_EXCL +are not given to +.Xr open 2 , +and thus a symbolic link race becomes possible, hence making +necessary the use of +.Xr fdopen 3 +as seen above). +Furthermore, one must be careful about code which opens, closes, and then +re-opens the file in question. +Finally, one must ensure that upon error the temporary file is +removed correctly. +.Pp +There are also cases where modifying the code to use +.Fn mktemp , +in concert with +.Xr open 2 +using the flags +.Dv O_CREAT +| +.Dv O_EXCL , +is better, as long as the code retries a new template if +.Xr open 2 +fails with an +.Va errno +of +.Er EEXIST . .Sh ERRORS The .Fn mktemp , @@ -179,6 +262,40 @@ The .Fn mkdtemp function appeared in .Nx 1.4 . +.Sh BUGS +For +.Fn mktemp +there is an obvious race between file name selection and file +creation and deletion: the program is typically written to call +.Xr tmpnam 3 , +.Xr tempnam 3 , +or +.Fn mktemp . +Subsequently, the program calls +.Xr open 2 +or +.Xr fopen 3 +and erroneously opens a file (or symbolic link, fifo or other +device) that the attacker has created in the expected file location. +Hence +.Fn mkstemp +is recommended, since it atomically creates the file. +An attacker can guess the filenames produced by +.Fn mktemp . +Whenever it is possible, +.Fn mkstemp +or +.Fn mkdtemp +should be used instead. +.Pp +For this reason, +.Xr ld 8 +will output a warning message whenever it links code that uses the +.Fn mktemp . +.Pp +The +.Fn mkdtemp +function is nonstandard and should not be used if portability is required. .Sh SECURITY CONSIDERATIONS The use of .Fn mktemp |
