{
struct sieve_file_script *fscript =
container_of(script, struct sieve_file_script, script);
+ struct sieve_file_storage *fstorage =
+ container_of(script->storage, struct sieve_file_storage,
+ storage);
struct stat st;
struct istream *result;
+ const char *error;
int fd;
- fd = open(fscript->path, O_RDONLY);
- if (fd < 0) {
- sieve_file_script_handle_error(fscript, "open", fscript->path,
- fscript->script.name);
- return -1;
+ /* For directory-based storage, open the script via the storage
+ directory fd so that path resolution refuses to follow symlinks
+ whose (recursive) target leaves the storage directory.
+ Single-file storages have no dir_fd, so fall back to plain open(). */
+ if (fstorage->dir_fd >= 0 && fscript->filename != NULL &&
+ *fscript->filename != '\0') {
+ if (sieve_file_storage_open_safe(fstorage, fscript->filename,
+ O_RDONLY, &fd, &error) < 0) {
+ if (errno == ELOOP) {
+ sieve_script_set_critical(
+ script,
+ "Failed to open sieve script: %s",
+ error);
+ script->storage->error_code =
+ SIEVE_ERROR_NO_PERMISSION;
+ return -1;
+ }
+ sieve_file_script_handle_error(fscript, "open",
+ fscript->path,
+ fscript->script.name);
+ return -1;
+ }
+ } else {
+ fd = open(fscript->path, O_RDONLY);
+ if (fd < 0) {
+ sieve_file_script_handle_error(fscript, "open",
+ fscript->path,
+ fscript->script.name);
+ return -1;
+ }
}
if (fstat(fd, &st) != 0) {
#include <stdio.h>
#include <unistd.h>
#include <ctype.h>
+#include <fcntl.h>
#include <utime.h>
#include <sys/time.h>
return t_strconcat(path, "/", filename , NULL);
}
+int sieve_file_storage_open_safe(struct sieve_file_storage *fstorage,
+ const char *path, int flags, int *fd_r,
+ const char **error_r)
+{
+ const char *walk_error;
+ int fd;
+
+ *fd_r = -1;
+
+ if (fstorage->dir_fd < 0) {
+ *error_r = "storage directory fd not available";
+ errno = ENOTSUP;
+ return -1;
+ }
+
+ fd = t_openat_safe(fstorage->dir_fd, path, flags, &walk_error);
+ if (fd < 0) {
+ *error_r = t_strdup_printf(
+ "Failed to open '%s/%s': %s",
+ fstorage->path, path, walk_error);
+ return -1;
+ }
+
+ *fd_r = fd;
+ return 0;
+}
+
/*
*
*/
fstorage = p_new(pool, struct sieve_file_storage, 1);
fstorage->storage = sieve_file_storage;
fstorage->storage.pool = pool;
+ fstorage->dir_fd = -1;
return &fstorage->storage;
}
+static void sieve_file_storage_destroy(struct sieve_storage *storage)
+{
+ struct sieve_file_storage *fstorage =
+ container_of(storage, struct sieve_file_storage, storage);
+
+ i_close_fd(&fstorage->dir_fd);
+}
+
static int
sieve_file_storage_get_full_path(struct sieve_file_storage *fstorage,
const char **storage_path)
fstorage->link_path =
p_strdup(storage->pool, link_path);
}
+
+ /* For personal (user-writable) storage, open a fd to the
+ canonical storage directory. This fd anchors TOCTOU-safe
+ path resolution for script lookups: the inode it refers to
+ cannot change underneath us, so even if the user mutates
+ intermediate path components on disk afterwards, we still
+ resolve relative to the original directory. The walker that
+ uses this fd refuses script paths that escape the storage
+ directory through symlinks or `..`, which would otherwise
+ let an unprivileged user redirect e.g. include "name" to a
+ file outside their own sieve storage.
+
+ Non-personal (e.g. admin-configured global) storage is
+ trusted; dir_fd stays unset there so legitimate
+ admin-managed symlinks crossing the storage boundary keep
+ working.
+
+ Only open the fd when storage_path actually resolves to a
+ directory: autodetect can leave is_file=FALSE while
+ storage_path still points at a regular file (see the
+ storage_path == active_path fallback in
+ sieve_file_storage_do_autodetect()). In that case there is
+ no directory to anchor to and lookups by name will fail
+ with ENOENT later anyway. */
+ if (storage->is_personal &&
+ S_ISDIR(fstorage->st.st_mode)) {
+ fstorage->dir_fd = open(storage_path,
+ O_RDONLY | O_DIRECTORY |
+ O_CLOEXEC);
+ if (fstorage->dir_fd < 0) {
+ sieve_storage_set_critical(storage,
+ "Failed to open storage directory: "
+ "open(%s) failed: %m", storage_path);
+ return -1;
+ }
+ }
}
fstorage->path = p_strdup(storage->pool, storage_path);
.v = {
.alloc = sieve_file_storage_alloc,
.init = sieve_file_storage_init,
+ .destroy = sieve_file_storage_destroy,
.autodetect = sieve_file_storage_autodetect,
time_t prev_mtime;
+ /* fd referencing the canonical (realpath'd) storage directory. Used to
+ anchor TOCTOU-safe path resolution for script files: lookups that
+ escape this directory via symlinks (or `..`) are refused. -1 if the
+ storage is a single-file storage or this protection is unavailable.
+ */
+ int dir_fd;
+
bool is_file:1;
};
int sieve_file_storage_pre_modify(struct sieve_storage *storage);
+/* Open a script file that lives under the storage directory, refusing any
+ path resolution that escapes that directory through symlinks or `..`.
+
+ The path is resolved component-by-component using openat() relative to
+ fstorage->dir_fd, with O_NOFOLLOW per component. Symlinks are followed
+ only if their (recursively resolved) target also stays beneath dir_fd;
+ absolute symlink targets and `..` past the storage root are refused.
+
+ Anchoring the resolution at dir_fd makes the check TOCTOU-safe: even if
+ the user mutates path components on disk between calls, dir_fd still
+ refers to the original directory inode.
+
+ `flags` is OR-ed into the openat() call for the final component (e.g.
+ O_RDONLY). O_NOFOLLOW and O_CLOEXEC are added automatically.
+
+ Returns 0 on success and stores the new fd in *fd_r. Returns -1 on
+ failure with errno set; *error_r is set to a descriptive message.
+ errno=ELOOP indicates either too many symlinks or an attempted escape.
+ errno=ENOTSUP indicates fstorage->dir_fd is not available; the caller
+ may fall back to opening fstorage->path directly.
+ */
+int sieve_file_storage_open_safe(struct sieve_file_storage *fstorage,
+ const char *path, int flags, int *fd_r,
+ const char **error_r);
+
/* Active script */
int sieve_file_storage_active_replace_link(struct sieve_file_storage *fstorage,
projects / dovecot.git / commitdiff