Bugzilla Bug 55424

from eupdatedb:
...
tmpfile =       "/tmp/esearchdb.py.tmp"
...
if exists(tmpfile):
    print red("Error: "), " there is probably another eupdatedb running already."
    ...
dbfile = open(tmpfile, "w")
dbfile.write("db = (")
...

obvious race condition there, but you dont have to try to beat it to make a nuisance of yourself :) You can make a file anywhere you like by making a broken symlink to it waiting for root to run eupdatedb...

for example, as a non-privileged user run:

ln -s /etc/nologin /tmp/esearchdb.py.tmp

wait for root to run eupdatedb, and you just stopped everyone logging in :)

Reproducible: Always
Steps to Reproduce:
1. as normal user, run ln -s /etc/nologin /tmp/esearchdb.py.tmp
2. wait for root to eupdatedb
3. DoS!
4. (race condition as well)

Actual Results:  
eupdatedb has insecure temp file handling procedure.

David --

Can you review/patch as appropriate?

Yes,

Thanks a lot for the bug report. I didn't know this problem. What would be the most reasonable way to fix this bug?

1. Delete /tmp/esearchdb.py.tmp, Open new file and write

If I use this solution, I have to find an other way to check if there is an instance of eupdatedb running.

2. Check if /tmp/esearchdb.py.tmp is a symlink -> delete or create

3. Other ways? Use a file in an other directory?

David

Thanks for a great utility btw David, regarding comment #2 , it looks like
python's open() supports O_EXCL and O_CREAT, could you use these flags when
opening the tmpfile (and check for failure)?

http://www.python.org/doc/current/lib/os-fd-ops.html

I'm not really a python programmer, so forgive me if this is considered very
poor :)

but, for example:

$ diff -u eupdatedb.py.orig eupdatedb.py
--- eupdatedb.py.orig   2004-06-29 00:00:03.148734752 +0100
+++ eupdatedb.py        2004-06-29 00:01:29.184655304 +0100
@@ -15,6 +15,7 @@

 from output import red, darkgreen, green, bold, nocolor
 from os import stat, unlink, environ
+from os import O_EXCL, O_CREAT, O_WRONLY, open, fdopen
 from os.path import exists
 from shutil import copyfile
 from getopt import *
@@ -133,7 +134,12 @@
     print "         If you're sure there is no other process, remove", tmpfile
     print ""
     sys.exit(1)
-dbfile = open(tmpfile, "w")
+try:
+    dbfd = open(tmpfile, O_CREAT | O_EXCL | O_WRONLY, 0600)
+except OSError:
+    print red("Error: "), " failed to open temporary file."
+    sys.exit(1)
+dbfile = fdopen(dbfd, "w")
 dbfile.write("db = (")

 if not verbose:

another way to 'fix' this would be to manage the file in ${PORTAGE_TMPDIR}
since that isnt a world writable directory

then you'd just have to 'worry' about attacks from other root users ;)

Thanks for your comments and the patch,
I will release esearch-0.6.2 with the fixed bug tomorrow.

David

esearch-0.6.2 committed, I was so free to mark it stable for everyone.

GLSA is drafted.

GLSA 200407-01.