...
This non-compliant coding example also violates FIO02-A. Canonicalize path names originating from untrusted sources and FIO03-A. Do not make assumptions about fopen() and file creation.
Compliant Solution (*NIX)
| Wiki Markup |
|---|
Some Unix based systems (such as OpenBSD) encourage restricting file system access by recommending the creation of a {{chroot()}} jail. The {{chroot}} jail requires care to implement securely \[[Wheeler 03|AA. C References#Wheeler 03]\]. This is achieved by passing a predefined directory name as an argument to {{chroot()}}. The call to {{chroot()}} requires superuser privileges and thus the program should be set-uid root. However, this call does not _leave_ the process inside the jail directory as one would expect. The {{chdir()}} call that follows does just this and is indispensable when access is to be restricted to within the jail boundaries. |
...