Update a file securely incase of symbolic links - C - c

Question

I am wondering if anyone could assist me with this, I am try to figure out how to handle a time of check, time of use problem and drop privileges when they are not needed, in case the for example it is a symbolic link to the file which could be changed to say the shadow file. Assuming the function below is invoked while the calling process is running with elevated privileges.
int
updatefile(char *file)
{
int fd;
if (access(file, R_OK|W_OK)) {
perror("access()");
return (-1);
}
fd = open(file, O_RDWR);
/*
* file is written to here.
*/
printf("Updated %s on...\n", file);
system("date");
/*
* elevated privileges are required here...
*/
return (0);
}

Answer 1

Assuming that your access function checks the file type and determines if the user has the appropriate privileges to manipulate the file, you are concerned about a potential TOCTTOU error between the call to access and the call to open.
The typical way to avoid this would be:
int updatefile(char *file)
{
int fd = -1;
if(-1 != (fd = open(file, R_OK | W_OK)))
{
struct stat buf;
if(0 == fstat(fd, &buf))
{
/* perform any necessary check on the here */
/* do what ever else you need to do */
/* write to the file here */
/* gain elevated permissions here */
/* do privileged task */
/* drop back to normal permissions here */
close(fd);
}
else
{
/* handle error stating the file */
}
}
else
{
/* handle error for not opening file */
}
}
The reason that this works, is that we postpone doing any checks on the file till after we get a "handle" to the file. We can tell if the user doesn't have the permissions to open the file by the value of errno in the outer else block;
If we are able to get a "handle" to the file, we then can do what ever checks we want. Because we maintain the "handle" from the time that we open the file, through when we perform our checks and finally when we use the file; a malicious would not be able to modify the file system between check and use.
Hope this helps
T.