c - Using File Descriptors with readlink() -
i have situation need file name can call readlink() function. have integer stored file descriptor via open() command. problem is, don't have access function open() command executed (if did, wouldn't posting this). return value open() stored in struct do have access to.
char buf[path_max]; char tempfd[2]; //file descriptor number of temporary file created tempfd[0] = fi->fh + '0'; tempfd[1] = '\0'; char parentfd[2]; //file descriptor number of original file parentfd[0] = (fi->fh - 1) + '0'; parentfd[1] = '\0'; if (readlink(tempfd, buf, sizeof(buf)) < 0) { log_msg("\treadlink() error\n"); perror("readlink() error"); } else log_msg("readlink() returned '%s' '%s'\n", buf, tempfd);
this part of fuse file system. struct called fi, , file descriptor stored in fh, of type uint64_t. because of way program executes, know 2 linked files have file descriptor numbers 1 apart. @ least that's working assumption, trying verify code.
this compiles, when run it, log file shows readlink error every time. file descriptors have correct integer values stored in them, it's not working.
does know how can file name these integer values? thanks!
if it's acceptable code becomes non portable , tied being run on modern version of linux, can use /proc/<pid>/fd/<fd>
. however, recommend against adding '0' fd means string representing number, because uses assumption fd < 10.
however best if able pick filename instead of relying on /proc
. @ least, can replace calls library's function wrapper function using linker flag. example of usage gcc program.c -wl,-wrap,thefunctiontobeoverriden -o program
, calls library function linked against __wrap_thefunctiontobeoverriden; original function accessible under name __real_thefunctiontobeoverriden. see answer https://stackoverflow.com/a/617606/111160 details.
but, answer not involving linkage rerouting: can like
char fd_path[100]; snprintf("/proc/%d/fd/%d", sizeof(fd_path), getpid(), fi->fh);
you should use /proc/...
path (it softlink) rather using path links to.
you can call readlink
find actual path in filesystem. however, doing introduces security vulnerability , suggest against using path readlink
returns.
when file descriptor points @ deleted,unlinked, can still access through /proc/...
path. however, when readlink
on it, original pathname (appended ' (deleted)' text).
if file /tmp/a.txt
, gets deleted, readlink
on /proc/...
path returns /tmp/a.txt (deleted)
. if path exists, able access it!, while wanted access different file (/tmp/a.txt
). attacker may able provide hostile contents in /tmp/a.txt (deleted)
file.
on other hand, if access file through /proc/...
path, access correct (unlinked still alive) file, if path claims link else.
Comments
Post a Comment