diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2017-02-15 18:45:19 +0100 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2017-02-27 12:35:10 +0100 |
| commit | b27fd90ad36f4194665744cc1dcdd05f2d0b47ef (patch) | |
| tree | a48e90c7facfabf56074685a342fabf7584b8b48 /include | |
| parent | d78d0d459d10dd12069de82d6735f1acf183c631 (diff) | |
| download | mariadb-git-b27fd90ad36f4194665744cc1dcdd05f2d0b47ef.tar.gz | |
MDEV-11902 mi_open race condition
TOCTOU bug. The path is checked to be valid, symlinks are resolved.
Then the resolved path is opened. Between the check and the open,
there's a window when one can replace some path component with a
symlink, bypassing validity checks.
Fix: after we resolved all symlinks in the path, don't allow open()
to resolve symlinks, there should be none.
Compared to the old MyISAM/Aria code:
* fastpath. Opening of not-symlinked files is just one open(),
no fn_format() and lstat() anymore.
* opening of symlinked tables doesn't do fn_format() and lstat() either.
it also doesn't to realpath() (which was lstat-ing every path
component), instead if opens every path component with O_PATH.
* share->data_file_name stores realpath(path) not readlink(path). So,
SHOW CREATE TABLE needs to do lstat/readlink() now (see ::info()),
and certain error messages (cannot open file "XXX") show the real
file path with all symlinks resolved.
Diffstat (limited to 'include')
| -rw-r--r-- | include/my_sys.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/include/my_sys.h b/include/my_sys.h index 82ab830e9c7..bb19a30497a 100644 --- a/include/my_sys.h +++ b/include/my_sys.h @@ -63,9 +63,9 @@ typedef struct my_aio_result { #define MY_FAE 8 /* Fatal if any error */ #define MY_WME 16 /* Write message on error */ #define MY_WAIT_IF_FULL 32 /* Wait and try again if disk full error */ -#define MY_IGNORE_BADFD 32 /* my_sync: ignore 'bad descriptor' errors */ -#define MY_UNUSED 64 /* Unused (was support for RAID) */ -#define MY_FULL_IO 512 /* For my_read - loop intil I/O is complete */ +#define MY_IGNORE_BADFD 32 /* my_sync(): ignore 'bad descriptor' errors */ +#define MY_NOSYMLINKS 512 /* my_open(): don't follow symlinks */ +#define MY_FULL_IO 512 /* my_read(): loop intil I/O is complete */ #define MY_DONT_CHECK_FILESIZE 128 /* Option to init_io_cache() */ #define MY_LINK_WARNING 32 /* my_redel() gives warning if links */ #define MY_COPYTIME 64 /* my_redel() copys time */ |