diff options
author | garga <garga@FreeBSD.org> | 2015-07-02 17:30:59 +0000 |
---|---|---|
committer | garga <garga@FreeBSD.org> | 2015-07-02 17:30:59 +0000 |
commit | 43727d164bcc91ce9ad967eb9ee136419df192d6 (patch) | |
tree | 117a7f93582c746c2d9f1203b60edb19ede05ae6 /usr.sbin/pwd_mkdb/pwd_mkdb.c | |
parent | 774c959e8c30079eb72afe189b6ec55ecec6aa69 (diff) | |
download | FreeBSD-src-43727d164bcc91ce9ad967eb9ee136419df192d6.zip FreeBSD-src-43727d164bcc91ce9ad967eb9ee136419df192d6.tar.gz |
When passwd or group information is changed (by pw, vipw, chpass, ...)
temporary file is created and then a rename() call move it to official file.
This operation didn't have any check to make sure data was written to disk
and if a power cycle happens system could end up with a 0 length passwd
or group database.
There is a pfSense bug with more infor about it:
https://redmine.pfsense.org/issues/4523
The following changes were made to protect passwd and group operations:
* lib/libutil/gr_util.c:
- Replace mkstemp() by mkostemp() with O_SYNC flag to create temp file
- After rename(), fsync() call on directory for faster result
* lib/libutil/pw_util.c
- Replace mkstemp() by mkostemp() with O_SYNC flag to create temp file
* usr.sbin/pwd_mkdb/pwd_mkdb.c
- Added O_SYNC flag on dbopen() calls
- After rename(), fsync() call on directory for faster result
* lib/libutil/pw_util.3
- pw_lock() returns a file descriptor to master password file on success
Differential Revision: https://reviews.freebsd.org/D2978
Approved by: bapt
Sponsored by: Netgate
Diffstat (limited to 'usr.sbin/pwd_mkdb/pwd_mkdb.c')
-rw-r--r-- | usr.sbin/pwd_mkdb/pwd_mkdb.c | 25 |
1 files changed, 20 insertions, 5 deletions
diff --git a/usr.sbin/pwd_mkdb/pwd_mkdb.c b/usr.sbin/pwd_mkdb/pwd_mkdb.c index 69a2fae..c382cb5 100644 --- a/usr.sbin/pwd_mkdb/pwd_mkdb.c +++ b/usr.sbin/pwd_mkdb/pwd_mkdb.c @@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$"); #include <err.h> #include <errno.h> #include <fcntl.h> +#include <libgen.h> #include <limits.h> #include <pwd.h> #include <signal.h> @@ -227,14 +228,14 @@ main(int argc, char *argv[]) clean = FILE_INSECURE; cp(buf2, buf, PERM_INSECURE); dp = dbopen(buf, - O_RDWR|O_EXCL, PERM_INSECURE, DB_HASH, &openinfo); + O_RDWR|O_EXCL|O_SYNC, PERM_INSECURE, DB_HASH, &openinfo); if (dp == NULL) error(buf); clean = FILE_SECURE; cp(sbuf2, sbuf, PERM_SECURE); sdp = dbopen(sbuf, - O_RDWR|O_EXCL, PERM_SECURE, DB_HASH, &openinfo); + O_RDWR|O_EXCL|O_SYNC, PERM_SECURE, DB_HASH, &openinfo); if (sdp == NULL) error(sbuf); @@ -291,13 +292,13 @@ main(int argc, char *argv[]) method = 0; } else { dp = dbopen(buf, - O_RDWR|O_CREAT|O_EXCL, PERM_INSECURE, DB_HASH, &openinfo); + O_RDWR|O_CREAT|O_EXCL|O_SYNC, PERM_INSECURE, DB_HASH, &openinfo); if (dp == NULL) error(buf); clean = FILE_INSECURE; sdp = dbopen(sbuf, - O_RDWR|O_CREAT|O_EXCL, PERM_SECURE, DB_HASH, &openinfo); + O_RDWR|O_CREAT|O_EXCL|O_SYNC, PERM_SECURE, DB_HASH, &openinfo); if (sdp == NULL) error(sbuf); clean = FILE_SECURE; @@ -721,13 +722,27 @@ void mv(char *from, char *to) { char buf[MAXPATHLEN]; + char *to_dir; + int to_dir_fd = -1; - if (rename(from, to)) { + /* + * Make sure file is safe on disk. To improve performance we will call + * fsync() to the directory where file lies + */ + if (rename(from, to) != 0 || + (to_dir = dirname(to)) == NULL || + (to_dir_fd = open(to_dir, O_RDONLY|O_DIRECTORY)) == -1 || + fsync(to_dir_fd) != 0) { int sverrno = errno; (void)snprintf(buf, sizeof(buf), "%s to %s", from, to); errno = sverrno; + if (to_dir_fd != -1) + close(to_dir_fd); error(buf); } + + if (to_dir_fd != -1) + close(to_dir_fd); } void |