...
| Wiki Markup |
|---|
On POSIX compliant systems the permissions may be restricted by the value of the POSIX {{umask()}} function \[[Open Group 04|AA. C References#Open Group 04]\]. |
| Wiki Markup |
|---|
The operating system modifies the access permissions by computing the intersection of the inverse of the umask and the permissions requested by the process \[[Viega 03|AA. C References#Viega 03]\]. For example, if the variable {{requested_permissions}} contained the permissions passed to the operating system to create a new file, the variable {{actual_permissions}} would be the actual permissions that the operating system would use to create the file: |
...
| Wiki Markup |
|---|
The {{fopen_s()}} function defined in ISO/IEC TR 24731-1 \[[ISO/IEC TR 24731-2006|AA. C References#ISO/IEC TR 24731-2006]\] can be used to create a file with restriced permissions. Specifically, ISO/IEC TR 24731-1 says: |
If the file is being created, and the first character of the mode string is not 'u', to the extent that the underlying system supports it, the file shall have a file permission that prevents other users on the system from accessing the file. If the file is being created and the first character of the mode string is 'u', then by the time the file has been closed, it shall have the system default file access permissions.
The 'u' character can be thought of as standing for "umask," meaning that these are the same permissions that the file would have been created with by fopen().
...
Using the POSIX function open() to create a file but failing to provide access permissions for that file may cause the file to be created with unintended access permissions. This omission has been known to lead to vulnerabilities ; (for instance, CVE-2006-1174).
| Code Block | ||
|---|---|---|
| ||
...
int fd = open(file_name, O_CREAT | O_WRONLY); /* access permissions are missing */
if (fd == -1){
/* Handle Error */
}
...
|
...
| Wiki Markup |
|---|
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.5.3, "The fopen function" |
| Wiki Markup |
|---|
\[[Open Group 04|AA. C References#Open Group 04]\] "The open function," "The umask function" |
...