Skip to content
Snippets Groups Projects
  1. Mar 29, 2023
    • Joel Holdsworth's avatar
      server: Use *at syscalls to implement temporary chmod behaviour · 5b216f63
      Joel Holdsworth authored
      
      When read-only files are opened with FILE_WRITE_ATTRIBUTES, server must temporarily chmod the file
      to grant sufficient permissions to allow the file to be opened.
      
      The previous implementation used stat(2), chmod(2), open(2) and fchmod(2) (or chmod(2) in the
      failure case). Therefore the file path was being resolved 3 or possible 4 times in rapid succession.
      These successive path resolutions provide an opportunity for a Time-of-Check/Time-of-Use (TOCTOU)
      race condition with other processes.
      
      This patch mitigates against this by first opening the fd of the parent directory, and then using
      fstatat(2), fchmodat(2) and openat(2) to open the file relative to its parent directory.
      
      This method does not completely eliminate the TOCTOU issue, but it does significantly reduce its
      extent.
      
      Signed-off-by: default avatarJoel Holdsworth <joel@airwebreathe.org.uk>
      5b216f63
    • Joel Holdsworth's avatar
      server: Allow to open files without permission bits. · ce3e4ec5
      Joel Holdsworth authored
      The Msys2 port of the pacman package manager creates a read-only lock file during package
      installation. When it is time to delete this file, pacman calls the Msys2 implementation of
      unlink(2). This function is implemented in msys2-runtime:
      
      https://github.com/msys2/msys2-runtime/blob/msys2-3.4.3/winsup/cygwin/syscalls.cc#L669
      
      A similar implementation exists in Cygwin:
      
      https://www.cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=winsup/cygwin/syscalls.cc;h=fff8af009fd15f9fda563d694439307cf628e123;hb=HEAD#l669
      
      The implementation works by first opening the file using NtOpenFile with FILE_WRITE_ATTRIBUTES
      permissions only, it then clears the FILE_ATTRIBUTE_READONLY flag using NtSetAttributesFile, then
      repoens the file with DELETE permissions.
      
      Wine uses POSIX file permissions as one its possible methods of storing the READONLY DOS attribute
      in addition to storing attributes in Samba-formatted user extentded attributes.
      
      Files that are opened with FILE_WRITE_ATTRIBUTES must be opened with O_WRONLY or O_RDWR, because
      write access is required to modify the extended attribute. However, this will fail if the POSIX file
      permissions are set to read-only.
      
      This patch solves the problem by temporarily modifying the file access permissions to enable it to
      be opened before restoring the permissions to their previous values.
      
      There are risks involved in doing this. Modifying the file permissions is a 4-step process:
      
        1. stat - read the existing access flags
        2. chmod - modify to allow write permission.
        3. open - attempt to open the file.
        4. fchmod/chmod - restore the access flags using the fd if possible.
      
      The process involves resolving the file path at least 3 times, which is somewhat vulnerable to
      TOCTOU race conditions. However, the timing will be very brief, and this process occurs in server
      meaning that other Wine threads will be excluded. Therefore, the impact is judged to be low.
      
      This patch was derived by the following wine-staging patches:
      
        * server-File_Permissions/0007-server-FILE_WRITE_ATTRIBUTES-should-succeed-for-read.patch
        * server-File_Permissions/0002-server-Allow-to-open-files-without-any-permission-bi.patch
      
      Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=50771
      
      
      Co-authored-by: default avatarSebastian Lackner <sebastian@fds-team.de>
      Signed-off-by: default avatarJoel Holdsworth <joel@airwebreathe.org.uk>
      ce3e4ec5
  2. Mar 23, 2023
  3. Mar 22, 2023
Loading