From: Jan Synacek <jan.synacek@gmail.com>
Date: Wed, 29 Mar 2017 06:25:52 +0000 (+0200)
Subject: basic: forbid rm_rf() to remove paths ending with ".." (#5653)
X-Git-Tag: v234~352
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ab883125704b9310dcdfcf7451a27e85609da76c;p=thirdparty%2Fsystemd.git

basic: forbid rm_rf() to remove paths ending with ".." (#5653)

Fixes: #5644
---

diff --git a/src/basic/rm-rf.c b/src/basic/rm-rf.c
index 08497af729c..bdaca264ffb 100644
--- a/src/basic/rm-rf.c
+++ b/src/basic/rm-rf.c
@@ -187,6 +187,13 @@ int rm_rf(const char *path, RemoveFlags flags) {
                 return -EPERM;
         }
 
+        /* Another safe-check. Removing "/path/.." could easily remove entire root as well.
+         * It's especially easy to do using globs in tmpfiles, like "/path/.*", which the glob()
+         * function expands to both "/path/." and "/path/..".
+         * Return -EINVAL to be consistent with rmdir("/path/."). */
+        if (endswith(path, "/..") || endswith(path, "/../"))
+                return -EINVAL;
+
         if ((flags & (REMOVE_SUBVOLUME|REMOVE_ROOT|REMOVE_PHYSICAL)) == (REMOVE_SUBVOLUME|REMOVE_ROOT|REMOVE_PHYSICAL)) {
                 /* Try to remove as subvolume first */
                 r = btrfs_subvol_remove(path, BTRFS_REMOVE_RECURSIVE|BTRFS_REMOVE_QUOTA);