From 926cb93b50d6a573dbbef59ff841960b9d824c37 Mon Sep 17 00:00:00 2001
From: Jakob Unterwurzacher
Date: Tue, 5 Dec 2017 23:11:46 +0100
Subject: fusefrontend_reverse: secure OpenDir against symlink races

...by using the new OpenNofollow helper.

The benchmark shows a small but acceptable performance loss:

  $ ./benchmark-reverse.bash
  LS:  2.182
  CAT: 18.221

Tracking ticket: https://github.com/rfjakob/gocryptfs/issues/165
---
 internal/fusefrontend_reverse/rfs.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'internal/fusefrontend_reverse')

diff --git a/internal/fusefrontend_reverse/rfs.go b/internal/fusefrontend_reverse/rfs.go
index 18468ee..0329cc9 100644
--- a/internal/fusefrontend_reverse/rfs.go
+++ b/internal/fusefrontend_reverse/rfs.go
@@ -17,6 +17,7 @@ import (
 	"github.com/rfjakob/gocryptfs/internal/fusefrontend"
 	"github.com/rfjakob/gocryptfs/internal/nametransform"
 	"github.com/rfjakob/gocryptfs/internal/pathiv"
+	"github.com/rfjakob/gocryptfs/internal/syscallcompat"
 	"github.com/rfjakob/gocryptfs/internal/tlog"
 )
 
@@ -253,9 +254,14 @@ func (rfs *ReverseFS) OpenDir(cipherPath string, context *fuse.Context) ([]fuse.
 		return nil, fuse.ToStatus(err)
 	}
 	// Read plaintext dir
-	entries, status := rfs.loopbackfs.OpenDir(relPath, context)
-	if entries == nil {
-		return nil, status
+	fd, err := syscallcompat.OpenNofollow(rfs.args.Cipherdir, relPath, syscall.O_RDONLY, 0)
+	if err != nil {
+		return nil, fuse.ToStatus(err)
+	}
+	defer syscall.Close(fd)
+	entries, err := syscallcompat.Getdents(fd)
+	if err != nil {
+		return nil, fuse.ToStatus(err)
 	}
 	if rfs.args.PlaintextNames {
 		return rfs.openDirPlaintextnames(cipherPath, entries)
-- 
cgit v1.2.3