search

michaelforney / swc

a library for making a simple Wayland compositor
MIT License
626 stars 53 forks source link

time of check, time of use issue with SWC_LAUNCH_REQUEST_OPEN_DEVICE #50

Closed coypoop closed 5 years ago

coypoop commented 5 years ago

This is under the assumption that launch and libswc are separate processes for privilege separation (I am not sure if this is true)

  1. libswc makes request SWC_LAUNCH_REQUEST_OPEN_DEVICE with (say) a valid DRM_MAJOR
  2. stat(...) is used to check it's DRM_MAJOR
  3. libswc quickly swaps the pathname for another file
  4. open(...) is now done on something that isn't a DRM_MAJOR, and maybe can be abused.

using open THEN fstat eliminates the TOCTOU issue (if this is a security check).

michaelforney commented 5 years ago

Should be fixed now. Thanks for reporting the issue!