Bug #331 - Don't create a /tmp/root directory insecurely

When finding the user's home directory to generate a subdirectory in $HOME/.config, we would
fall back to /tmp if there were no environment variables for HOME or XDG_CONFIG_HOME.

Since libimobiledevice gets used by upower, and since upowerd runs as root, this would cause
a /tmp/root directory to be created insecurely, leaving upowerd vulnerable to a symlink attack.

Now we fall back to getpwuid_r() to find the user's home directory if it is not provided
in environment variables - this is the case when upowerd gets run via systemd, for example.
The result is that we'll end up creating /root/.config, a safe directory, since regular
users cannot create symlinks in /root.

In the future we'll need a way for libimobiledevice to find where to store its pairing data
on behalf of the console user, rather than writing it to /root.

http://libiphone.lighthouseapp.com/projects/27916-libiphone/tickets/331-insecure-tmp-directory-use

1 files changed, 76 insertions, 29 deletions

diff --git a/common/userpref.c b/common/userpref.c
index d363b0e..ab3a3cf 100644
--- a/common/userpref.c
+++ b/common/userpref.c
@@ -26,6 +26,9 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/types.h>
+#include <pwd.h>
+#include <unistd.h>
 #ifdef HAVE_OPENSSL
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
@@ -48,6 +51,7 @@
 
 #include "userpref.h"
 #include "debug.h"
+#include "utils.h"
 
 #define LIBIMOBILEDEVICE_CONF_DIR  "libimobiledevice"
 #define LIBIMOBILEDEVICE_CONF_FILE "libimobiledevicerc"
@@ -65,7 +69,7 @@
 #define DIR_SEP_S "/"
 #endif
 
-static char __config_dir[512] = {0, };
+static char *__config_dir = NULL;
 
 #ifdef WIN32
 static char *userpref_utf16_to_utf8(wchar_t *unistr, long len, long *items_read, long *items_written)
@@ -103,24 +107,60 @@ static char *userpref_utf16_to_utf8(wchar_t *unistr, long len, long *items_read,
 #endif
 
 #ifndef WIN32
-static const char *userpref_get_tmp_dir()
+static char *get_home_dir_from_system(void)
 {
-	const char *cdir = getenv("TMPDIR");
-	if (cdir && cdir[0])
-		return cdir;
-	cdir = getenv("TMP");
-	if (cdir && cdir[0])
-		return cdir;
-	cdir = getenv("TEMP");
-	if (cdir && cdir[0])
-		return cdir;
-	return "/tmp";
+	long bufsize;
+	char *buf;
+	int error;
+	struct passwd pwd;
+	struct passwd *ppwd;
+	char *result = NULL;
+
+	bufsize = sysconf (_SC_GETPW_R_SIZE_MAX);
+
+	if (bufsize < 0)
+		bufsize = 1024;
+
+	buf = NULL;
+
+	do {
+		free (buf);
+		buf = malloc (bufsize);
+		if (!buf)
+			return NULL;
+
+		errno = 0;
+		error = getpwuid_r (getuid (), &pwd, buf, bufsize, &ppwd);
+
+		error = (error < 0) ? errno : error;
+
+		if (!ppwd) {
+			if (error == 0 || error == ENOENT)
+				break;
+			else if (bufsize > 32 * 1024)
+				break; /* Unreasonable size; let's bail out */
+
+			bufsize *= 2;
+		}
+	} while (!ppwd);
+
+	if (ppwd && ppwd->pw_dir)
+		result = strdup (ppwd->pw_dir);
+
+	free (buf);
+
+	return result;
 }
 #endif
 
 static const char *userpref_get_config_dir()
 {
-	if (__config_dir[0]) return __config_dir;
+	char *base_config_dir;
+	int use_dot_config;
+
+	if (__config_dir)
+		return __config_dir;
+
 #ifdef WIN32
 	wchar_t path[MAX_PATH+1];
 	HRESULT hr;
@@ -131,38 +171,45 @@ static const char *userpref_get_config_dir()
 	if (hr == S_OK) {
 		b = SHGetPathFromIDListW (pidl, path);
 		if (b) {
-			char *cdir = userpref_utf16_to_utf8 (path, wcslen(path), NULL, NULL);
-			strcpy(__config_dir, cdir);
-			free(cdir);
+			base_config_dir = userpref_utf16_to_utf8 (path, wcslen(path), NULL, NULL);
 			CoTaskMemFree (pidl);
 		}
 	}
+
+	use_dot_config = 0;
 #else
 	const char *cdir = getenv("XDG_CONFIG_HOME");
 	if (!cdir) {
 		cdir = getenv("HOME");
 		if (!cdir || !cdir[0]) {
-			const char *tdir = userpref_get_tmp_dir();
-			strcpy(__config_dir, tdir);
-			strcat(__config_dir, DIR_SEP_S);
-			strcat(__config_dir, "root");
+			base_config_dir = get_home_dir_from_system();
+			if (!base_config_dir)
+				return NULL;
 		} else {
-			strcpy(__config_dir, cdir);
+			base_config_dir = strdup(cdir);
 		}
-		strcat(__config_dir, DIR_SEP_S);
-		strcat(__config_dir, ".config");
+
+		use_dot_config = 1;
 	} else {
-		strcpy(__config_dir, cdir);
+		base_config_dir = strdup(cdir);
+		use_dot_config = 0;
 	}
 #endif
-	strcat(__config_dir, DIR_SEP_S);
-	strcat(__config_dir, LIBIMOBILEDEVICE_CONF_DIR);
 
-	int i = strlen(__config_dir)-1;	
-	while ((i > 0) && (__config_dir[i] == DIR_SEP)) {
-		__config_dir[i--] = '\0';
+	if (use_dot_config)
+		__config_dir = string_concat(base_config_dir, DIR_SEP_S, ".config", DIR_SEP_S, LIBIMOBILEDEVICE_CONF_DIR);
+	else
+		__config_dir = string_concat(base_config_dir, DIR_SEP_S, LIBIMOBILEDEVICE_CONF_DIR);
+
+	if (__config_dir) {
+		int i = strlen(__config_dir)-1;	
+		while ((i > 0) && (__config_dir[i] == DIR_SEP)) {
+			__config_dir[i--] = '\0';
+		}
 	}
 
+	free(base_config_dir);
+
 	return __config_dir;
 }