mount.cifs: check access of credential files before opening

It's possible for an unprivileged user to pass a setuid mount.cifs a
credential or password file to which he does not have access. This can cause
mount.cifs to open the file on his behalf and possibly leak the info in the
first few lines of the file.

Check the access permissions of the file before opening it.

Reported-by: Ronald Volgers <r.c.volgers@student.utwente.nl>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Steve French <sfrench@us.ibm.com>

diff --git a/client/mount.cifs.c b/client/mount.cifs.c
index 1c04e13c8d63aa30657d79f9a55d65d959e23af7..0f41afff9cc6d4c59a30646dd8cfe4e6529f7d64 100644 (file)
--- a/client/mount.cifs.c
+++ b/client/mount.cifs.c
@@ -320,6 +320,11 @@ static int open_cred_file(char * file_name)
        char * temp_val;
        FILE * fs;
        int i, length;
+
+       i = access(file_name, R_OK);
+       if (i)
+               return i;
+
        fs = fopen(file_name,"r");
        if(fs == NULL)
                return errno;
@@ -442,6 +447,12 @@ static int get_password_from_file(int file_descript, char * filename)
        }
 
        if(filename != NULL) {
+               rc = access(filename, R_OK);
+               if (rc) {
+                       fprintf(stderr, "mount.cifs failed: access check of %s failed: %s\n",
+                                       filename, strerror(errno));
+                       exit(EX_SYSERR);
+               }
                file_descript = open(filename, O_RDONLY);
                if(file_descript < 0) {
                        fprintf(stderr, "mount.cifs failed. %s attempting to open password file %s\n",