FIO06-A. Create files with appropriate access permissions

Creating a file with weak access permissions may allow unintended access to that file. Although access permissions are heavily dependent on the operating system, many file creation functions provide mechanisms to set (or at least influence) access permissions. When these functions are used to create files, appropriate access permissions should be specified to prevent unintended access.

Non-Compliant Code Example: fopen()

The fopen() function does not allow the programmer to explicitly specify file access permissions. In the example below, if the call to fopen() creates a new file, the access permissions for that file will be implementation defined.

...
FILE * fptr = fopen(file_name, "w");
if (!fptr){
  /* Handle Error */
}
...

Implementation Details

On POSIX compliant systems the permissions may be restricted by the value of the POSIX umask() function Open Group 04.

For Linux operating systems, any created files will have mode S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH (0666), as modified by the process' umask value (see fopen(3)).

OpenBSD has the same rule (see fopen(3)).

Compliant Solution: fopen_s() (ISO/IEC TR 24731-1)

The fopen_s() function defined in ISO/IEC TR 24731-2006 can be used to create a file with restriced permissions. Specifically, ISO/IEC TR 24731-1 says:

If the file is being created, and the first character of the mode string is not 'u', to the extent that the underlying system supports it, the file shall have a file permission that prevents other users on the system from accessing the file. If the file is being created and first character of the mode string is 'u', then by the time the file has been closed, it shall have the system default file access permissions.

The 'u' character can be thought of as standing for "umask" meaning that these are the same permissions that the file would have been created with by fopen().

...
File *fptr;
errno_t res = fopen_s(&fptr,file_name, "w");
if (res != 0) {
  /* Handle Error */
}
...

Non-Compliant Code Example: open() (POSIX)

Using the POSIX function open() to create a file but failing to provide access permissions for that file may cause the file to be created with unintended access permissions. This omission has been known to lead to vulnerabilities; for instance, CVE-2006-1174.

...
int fd = open(file_name, O_CREAT | O_WRONLY); /* access permissions are missing */
if (fd == -1){
  /* Handle Error */
}
...

Compliant Solution: {open()}} (POSIX)

Access permissions for the newly created file should be specified in the third parameter to open(). Again, the permissions may be influenced by the value of umask().

...
int fd = open(file_name, O_CREAT | O_WRONLY, file_access_permissions);
if (fd == -1){
  /* Handle Error */
}
...

Risk Assessment

Creating files with weak access permissions may allow unintended access to those files.

References

• ISO/IEC 9899-1999 Section 7.19.5.3, The fopen function
• Open Group 04 The open function
• Open Group 04 The umask function
• ISO/IEC TR 24731-2006 Section 6.5.2.1, The fopen_s function
• CVE-2006-1174