aboutsummaryrefslogtreecommitdiff
path: root/internal/fusefrontend_reverse/rfs.go
diff options
context:
space:
mode:
authorJakob Unterwurzacher2017-12-06 00:05:28 +0100
committerJakob Unterwurzacher2017-12-06 00:06:31 +0100
commita3bdc2bf2b7b7ed34e2d68fc698e1dd136f2e67a (patch)
tree1f651ae683806188716b9cf212edb66d5571bb41 /internal/fusefrontend_reverse/rfs.go
parent03bf604fc08abc9bb2d75bde21c96c9df4894a3b (diff)
fusefrontend_reverse: secure GetAttr against symlink races
...by using the OpenNofollow helper & Fstatat. Also introduce a helper to convert from unix.Stat_t to syscall.Stat_t. Tracking ticket: https://github.com/rfjakob/gocryptfs/issues/165
Diffstat (limited to 'internal/fusefrontend_reverse/rfs.go')
-rw-r--r--internal/fusefrontend_reverse/rfs.go19
1 files changed, 10 insertions, 9 deletions
diff --git a/internal/fusefrontend_reverse/rfs.go b/internal/fusefrontend_reverse/rfs.go
index 0329cc9..0b9e34c 100644
--- a/internal/fusefrontend_reverse/rfs.go
+++ b/internal/fusefrontend_reverse/rfs.go
@@ -7,6 +7,8 @@ import (
"path/filepath"
"syscall"
+ "golang.org/x/sys/unix"
+
"github.com/hanwen/go-fuse/fuse"
"github.com/hanwen/go-fuse/fuse/nodefs"
"github.com/hanwen/go-fuse/fuse/pathfs"
@@ -150,15 +152,13 @@ func (rfs *ReverseFS) GetAttr(relPath string, context *fuse.Context) (*fuse.Attr
if err != nil {
return nil, fuse.ToStatus(err)
}
- absPath, _ := rfs.abs(pRelPath, nil)
- // Stat the backing file
- var st syscall.Stat_t
- if relPath == "" {
- // Look through symlinks for the root dir
- err = syscall.Stat(absPath, &st)
- } else {
- err = syscall.Lstat(absPath, &st)
+ // Stat the backing file/dir using Fstatat
+ var st unix.Stat_t
+ dirFd, err := syscallcompat.OpenNofollow(rfs.args.Cipherdir, filepath.Dir(pRelPath), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+ if err != nil {
+ return nil, fuse.ToStatus(err)
}
+ err = syscallcompat.Fstatat(dirFd, filepath.Base(pRelPath), &st, unix.AT_SYMLINK_NOFOLLOW)
if err != nil {
return nil, fuse.ToStatus(err)
}
@@ -169,7 +169,8 @@ func (rfs *ReverseFS) GetAttr(relPath string, context *fuse.Context) (*fuse.Attr
return nil, fuse.ToStatus(syscall.EOVERFLOW)
}
var a fuse.Attr
- a.FromStat(&st)
+ st2 := syscallcompat.Unix2syscall(st)
+ a.FromStat(&st2)
// Calculate encrypted file size
if a.IsRegular() {
a.Size = rfs.contentEnc.PlainSizeToCipherSize(a.Size)