Have a look.
I haven't gotten lar to build, but the function works in a separate test program.
//Peter
Peter Stuge wrote:
-int mkdirp(const char *dirpath, mode_t mode) +/**
- Create a new directory including any missing parent directories.
- @param parent Return an error if a new directory would be created outside
- this directory. Pass "/" to allow new directories to be created anywhere.
- @param dirpath The new directory that should be created.
- @param mode Permissions to use for newly created directories.
- */
+int mkdirp(const char *parent, const char *dirpath, mode_t mode)
conflicts with: (where libgen is a compatibility dummy in solaris 10 at least, deferring that object to libc, so it always conflicts)
String Pattern-Matching Library Functions mkdirp(3GEN)
NAME mkdirp, rmdirp - create or remove directories in a path
SYNOPSIS cc [ flag ... ] file ... -lgen [ library ... ] #include <libgen.h>
int mkdirp(const char *path, mode_t mode); [...]
Regards, Patrick Georgi
Hey,
On Thu, Jul 12, 2007 at 10:24:03AM +0200, Patrick Georgi wrote:
+int mkdirp(const char *parent, const char *dirpath, mode_t mode)
conflicts with: (where libgen is a compatibility dummy in solaris 10 at least, deferring that object to libc, so it always conflicts)
int mkdirp(const char *path, mode_t mode);
Thanks!
New patch, rename mkdirp() to mkdirp_below(). :)
I just had a thought; parent and dirpath are currently treated as either absolute or relative cwd but perhaps dirpath should always be treated as absolute or relative parent instead?
mkdirp_below("subdir","x/y/z",077);
would create subdir/x/y/z. Feels much more intuitive, no?
//Peter
* Peter Stuge peter@stuge.se [070712 09:50]:
Have a look.
I haven't gotten lar to build, but the function works in a separate test program.
//Peter
Make mkdirp() abort directory creation and return an error if a directory in dirpath is located outside the specified parent directory. Use the parent "/" to allow new directories anywhere.
Are you trying to avoid an exploit, or what is it needed for?
mkdirp should not be changed to take other parameters than this: http://docsun.cites.uiuc.edu/sun_docs/C/solaris_9/SUNWaman/hman3gen/mkdirp.3...
On Thu, Jul 12, 2007 at 10:57:08AM +0200, Stefan Reinauer wrote:
Make mkdirp() abort directory creation and return an error if a directory in dirpath is located outside the specified parent
Are you trying to avoid an exploit, or what is it needed for?
Right. But it was much more of a mess than I first thought. I forgot that realpath() only works when the full path already exists.
mkdirp should not be changed to take other parameters than this: http://docsun.cites.uiuc.edu/sun_docs/C/solaris_9/SUNWaman/hman3gen/mkdirp.3...
Aye.
//Peter
* Peter Stuge peter@stuge.se [070712 09:50]:
Have a look.
I haven't gotten lar to build, but the function works in a separate test program.
I think the better way would be to check the paths for ../ and skip those with a warning.
Stefan
On Thu, Jul 12, 2007 at 02:49:36PM +0200, Stefan Reinauer wrote:
- Peter Stuge peter@stuge.se [070712 09:50]:
Have a look.
I think the better way would be to check the paths for ../ and skip those with a warning.
Then there are the symlinks. :\
//Peter
On Thu, Jul 12, 2007 at 05:33:57PM +0200, Peter Stuge wrote:
On Thu, Jul 12, 2007 at 02:49:36PM +0200, Stefan Reinauer wrote:
- Peter Stuge peter@stuge.se [070712 09:50]:
Have a look.
I think the better way would be to check the paths for ../ and skip those with a warning.
Then there are the symlinks. :\
Yeah, this stuff is horribly hard to get right. Security issues like these are found even in really mature and stable software (coreutils, tar, etc.) again and again...
Uwe.
* Peter Stuge peter@stuge.se [070712 17:33]:
On Thu, Jul 12, 2007 at 02:49:36PM +0200, Stefan Reinauer wrote:
- Peter Stuge peter@stuge.se [070712 09:50]:
Have a look.
I think the better way would be to check the paths for ../ and skip those with a warning.
Then there are the symlinks. :\
Ok, Acked-by: Stefan Reinauer stepan@coresystems.de
On Fri, Jul 13, 2007 at 10:48:54AM +0200, Stefan Reinauer wrote:
Acked-by: Stefan Reinauer stepan@coresystems.de
r453 with small doxygen documentation improvement.
//Peter
-
Patrick Georgi -
Peter Stuge -
Stefan Reinauer -
Uwe Hermann