Re: [Bug-cpio] [PATCH] symlink target sanity check to prevent --no-absol

On Thu, Jun 15, 2017 at 9:37 PM, Cedric Buissart <address@hidden> wrote:

Attempt n.2 :
Created a function that walks the whole path. If anything not-directory is found, return an error. If the path is not fully created, we consider that a success and let cpio decides when time has come.
Files will be skipped if no-absolute-path is set and error is return.

On Wed, Jun 7, 2017 at 10:46 AM, Pavel Raiskup <address@hidden> wrote:
On Wednesday, June 7, 2017 10:07:21 AM CEST Cedric Buissart wrote:
> > In other words and IMO, if we were about to fix this issue - we should only
> > refuse to extract files through symlinks.
>
> Through any symlinks, or only those created by the archive itself ?

Remembering the extracted links might be expensive, and with
--no-absolute-filenames we want to stay in CWD anyway - no matter how the links
in CWD were created.

> The latter might look less restrictive, but what happens if a local
> attacker is able to create a symlink. Is it something that should be
> considered ?

Usually user should avoid races manually when running archiver:
https://www.gnu.org/software/tar/manual/html_node/Race-conditions.html
based on the above, I did not try to avoid races.

Pavel

--
Cedric Buissart,
Product Security

Cedric Buissart,
Product Security

From:	Cedric Buissart
Subject:	Re: [Bug-cpio] [PATCH] symlink target sanity check to prevent --no-absolute-filenames bypass
Date:	Tue, 4 Jul 2017 15:39:54 +0200