mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-06-07 17:52:38 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Disable symlinks: use O_SEARCH|O_DIRECTORY to open path components.

Browse Source
This commit is contained in:
Valentin Bartenev 2012-02-21 15:10:13 +00:00
parent 15b3173c5e
commit 86c5513ecb
2 changed files with 31 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
src/core/ngx_open_file_cache.c
View File

@ -565,7 +565,6 @@ ngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
u_char *p, *cp, *end; u_char *p, *cp, *end;
ngx_fd_t at_fd; ngx_fd_t at_fd;
ngx_str_t at_name; ngx_str_t at_name;
ngx_file_info_t fi;
if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_OFF) { if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_OFF) {
fd = ngx_open_file(name->data, mode, create, access); fd = ngx_open_file(name->data, mode, create, access);
@ -586,7 +585,7 @@ ngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
if (*p == '/') { if (*p == '/') {
at_fd = ngx_open_file("/", at_fd = ngx_open_file("/",
NGX_FILE_RDONLY|NGX_FILE_NONBLOCK, NGX_FILE_SEARCH|NGX_FILE_NONBLOCK,
NGX_FILE_OPEN, 0); NGX_FILE_OPEN, 0);
if (at_fd == NGX_INVALID_FILE) { if (at_fd == NGX_INVALID_FILE) {
@ -617,12 +616,12 @@ ngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER) { if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER) {
fd = ngx_openat_file_owner(at_fd, p, fd = ngx_openat_file_owner(at_fd, p,
NGX_FILE_RDONLY|NGX_FILE_NONBLOCK, NGX_FILE_SEARCH|NGX_FILE_NONBLOCK,
NGX_FILE_OPEN, 0, log); NGX_FILE_OPEN, 0, log);
} else { } else {
fd = ngx_openat_file(at_fd, p, fd = ngx_openat_file(at_fd, p,
NGX_FILE_RDONLY|NGX_FILE_NONBLOCK|NGX_FILE_NOFOLLOW, NGX_FILE_SEARCH|NGX_FILE_NONBLOCK|NGX_FILE_NOFOLLOW,
NGX_FILE_OPEN, 0); NGX_FILE_OPEN, 0);
} }
@ -647,35 +646,18 @@ ngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
if (p == end) { if (p == end) {
/* /*
* If pathname ends with a trailing slash, check if last path * If pathname ends with a trailing slash, assume the last path
* component is a directory; if not, fail with ENOTDIR as per * component is a directory and reopen it with requested flags;
* POSIX. * if not, fail with ENOTDIR as per POSIX.
* *
* We use separate check instead of O_DIRECTORY in the loop above, * We cannot rely on O_DIRECTORY in the loop above to check
* as O_DIRECTORY doesn't work on FreeBSD 8. * that the last path component is a directory because
* * O_DIRECTORY doesn't work on FreeBSD 8. Fortunately, by
* Note this returns already opened file descriptor, with different * reopening a directory, we don't depend on it at all.
* mode/create/access. This is believed to be safe as we don't
* use this codepath to create directories.
*/ */
if (ngx_fd_info(at_fd, &fi) == NGX_FILE_ERROR) { fd = ngx_openat_file(at_fd, ".", mode, create, access);
of->err = ngx_errno; goto done;
of->failed = ngx_fd_info_n;
fd = NGX_INVALID_FILE;
goto failed;
}
if (ngx_is_dir(&fi)) {
return at_fd;
}
of->err = ENOTDIR;
of->failed = ngx_openat_file_n;
fd = NGX_INVALID_FILE;
goto failed;
} }
if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER
@ -687,6 +669,8 @@ ngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
fd = ngx_openat_file(at_fd, p, mode|NGX_FILE_NOFOLLOW, create, access); fd = ngx_openat_file(at_fd, p, mode|NGX_FILE_NOFOLLOW, create, access);
} }
done:
if (fd == NGX_INVALID_FILE) { if (fd == NGX_INVALID_FILE) {
of->err = ngx_errno; of->err = ngx_errno;
of->failed = ngx_openat_file_n; of->failed = ngx_openat_file_n;

17
src/os/unix/ngx_files.h
View File

@ -78,8 +78,25 @@ typedef struct {
#if (NGX_HAVE_OPENAT) #if (NGX_HAVE_OPENAT)
#define NGX_FILE_NOFOLLOW O_NOFOLLOW #define NGX_FILE_NOFOLLOW O_NOFOLLOW
#if defined(O_DIRECTORY)
#define NGX_FILE_DIRECTORY O_DIRECTORY
#else
#define NGX_FILE_DIRECTORY 0
#endif #endif
#if defined(O_SEARCH)
#define NGX_FILE_SEARCH O_SEARCH|NGX_FILE_DIRECTORY
#elif defined(O_EXEC)
#define NGX_FILE_SEARCH O_EXEC|NGX_FILE_DIRECTORY
#else
#define NGX_FILE_SEARCH O_RDONLY|NGX_FILE_DIRECTORY
#endif
#endif /* NGX_HAVE_OPENAT */
#define NGX_FILE_DEFAULT_ACCESS 0644 #define NGX_FILE_DEFAULT_ACCESS 0644
#define NGX_FILE_OWNER_ACCESS 0600 #define NGX_FILE_OWNER_ACCESS 0600