6

The man page for access(2) tells :

Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the user might exploit the short time interval between checking and opening the file to manipulate it. For this reason, the use of this system call should be avoided.

So, what kind of security hole it creates?

If somebody doesn't like linux.die.net, here is from freebsd.org and manpagez with similar text to avoid use of access().

| improve this question | |
9

It is a race condition. You do the access(), then you do the open(). In the small time between the two calls, the file may have changed. Typically, the file is, say, /tmp/foo. Initially, the file is owned by some user (who is the bad guy of the story), and the target is some root-powered application. The application does the access(), sees that the file really belongs to the user, and thus thinks: "that's fine, it's his file, I can process it on his behalf". Then the bad guy quickly replaces the file with a symbolic link to /etc/shadow. The application has already taken the decision to open /tmp/foo, but when it does, it really opens and processes /etc/shadow.

| improve this answer | |
  • Sounds good. I guess that is done through some script or something (maybe even a virus), since the time hole can be really small (like 10s of microseconds). What kind of processing should be done on other file to gain root access? Do you have a real example? – BЈовић Sep 19 '13 at 14:30
  • In a multi-tasking OS, when there are more running applications than available CPU cores, several threads must share the same core, which the OS does by switching from one thread to another, about 100 to 400 times per second (it depends on the OS). So the delay may, with luck, on the order to 2.5 to 10 milliseconds and you can do a lot on a machine in 2.5 milliseconds. As for the actual exploit, imagine for instance a file viewer which runs as root; in the access() then open() case, the race condition can be used to view any file readable by root. – Thomas Pornin Sep 19 '13 at 14:47
  • Ok, seeing there are things like this, that can be useful. – BЈовић Sep 19 '13 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.