VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.34k stars 1.45k forks source link

proc/linux: Don't open mmapped files before checking stat results #2002

Closed hillu closed 1 year ago

hillu commented 1 year ago

Instead of checking the filesystem containing the mapped file against specific magic device numbers, we use stat(2) before actually opening the file. (The open call can block on certain device nodes as reported in #1929.)

To overcome the possible TOCTOU issue between stat() and open(), we double-check device, inode after we have opened the file.

This also reverts commit 50eeef4f84f8f5719993a56cc10f1760c1f8dc19.

The original problem could also have been fixed by passing O_PATH to open(2). However, there seems to be no way to atomically upgrade those path-only fds to real file descriptors that we can mmap or read from, so this would not helped in overcoming the TOCTOU issue.