[Bug hurd/34493] New: __file_name_lookup_at does not apply umask for O_TMPFILE creation

https://sourceware.org/bugzilla/show_bug.cgi?id=34493

            Bug ID: 34493
           Summary: __file_name_lookup_at does not apply umask for
                    O_TMPFILE creation
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: hurd
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: [email protected], tschwinge at sourceware dot org
  Target Milestone: ---
             Flags: security?

Created attachment 16912
  --> https://sourceware.org/bugzilla/attachment.cgi?id=16912&action=edit
Flaw report

This code in hurd/lookup-at.c does not take the process umask into account:

  if (orig_flags & O_TMPFILE)
    {
      /* What we have looked up is not the file itself, but actually
         the directory to create the file in.  Do that now.  */
      file_t dir = result;

      err = __dir_mkfile (dir, orig_flags & ~(O_TMPFILE | O_DIRECTORY),
                          mode, &result);
      __mach_port_deallocate (__mach_task_self (), dir);
      if (err)
        {
          __hurd_fail (err);
          return MACH_PORT_NULL;
        }
    }

I'm not sure if this is a vulnerability. I would say it's definitely a bug.

For this to matter, the application would have to use a permissive mode (such
as 0666 on Linux) and expect to be reduced by the umask on Linux, and it would
have to use linkat to give the file a name, and the underlying translator must
actually support this operation (which may not be the case on Hurd).

I've been instructed to mention this: Found by AISLE in partnership with Red
Hat

-- 
You are receiving this mail because:
You are on the CC list for the bug.