Many file related security vulnerabilities result from a program accessing a file object different from the one intended. In ISO/IEC 9899-1999 C character-based filenames are bound to underlying file objects in name only. Filenames provide no information regarding the nature of the file object itself. Furthermore, the binding of a filename to a file object is reasserted every time the filename is used in an operation. File descriptors and FILE pointers are bound to underlying file objects by the operating system.
Accessing files via file descriptors or FILE pointers rather than file names provides a greater level of certainty with regard to the object that is actually acted on. It is recommended that files be accessed through file descriptors or FILE pointers where possible.
Non-Compliant Example
In this example, the function chmod() is called to set the permissions of a file. However, it is not clear whether the file object referred to by file_name refers to the same object in the call to fopen() and in the call to chmod().
...
FILE * f_ptr = fopen(file_name,"w");
f_ptr = fopen(file_name,"w");
if (!f_ptr) {
/* Handle fopen() Error */
}
...
if (chmod(file_name, new_mode) == -1) {
/* Handle chmod() Error */
}
/* Process file */
Compliant Solution (POSIX)
This compliant solution uses variants of the functions used in the non-compliant code example that operate on file descriptors or file pointers rather than file names. This provides a greater level of certainty that the file opened is the same file that is operated on.
...
fd = open(file_name, O_WRONLY | O_CREAT | O_EXCL, file_mode);
if (fd == -1) {
/* Handle open() error */
}
...
if (fchmod(fd, new_mode) == -1) {
/* Handle fchmod() Error */
}
/* Process file */
...
The fchmod() function is fined in IEEE Std 1003.1, 2004 Open Group 04 and can only be used on POSIX-compliant systems.
Priority: Level:
Many file related vulnerabilities are exploited to cause a program to access an unintended file. Accessing files through file descriptors instead of file names reduces the chance of accessing an unintended file.
Component |
Value |
|---|---|
Severity |
|
Likelihood |
|
Remediation cost |
|
References
- Seacord 05 Chapter 7, File I/O
- ISO/IEC 9899-1999 Sections 7.19.3, Files
- ISO/IEC 9899-1999 Sections 7.19.4, Operations on Files
- Apple Secure Coding Guide Avoiding Race Conditions and Insecure File Operations
- Open Group 04 The open function
- Drepper 06 Section 2.2.1 Identification When Opening