X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=udev-remove.c;h=7ad7c2402a8e05f77d23a1451ab9b891372a8116;hp=dc6fcfc331e7c8d16305dd45f4fd9497f4c6aea0;hb=a2383407b3c77f63234c482a2b27b0d45cd4a791;hpb=dd64e26b0c88892b367f57c4c7a7484e35641c7c

diff --git a/udev-remove.c b/udev-remove.c
index dc6fcfc33..7ad7c2402 100644
--- a/udev-remove.c
+++ b/udev-remove.c
@@ -31,7 +31,6 @@
 #include "udev.h"
 #include "udev_lib.h"
 #include "udev_version.h"
-#include "udev_dbus.h"
 #include "logging.h"
 #include "namedev.h"
 #include "udevdb.h"
@@ -66,6 +65,41 @@ static int delete_path(char *path)
 	return 0;
 }
 
+/** Remove all permissions on the device node, before
+  * unlinking it. This fixes a security issue.
+  * If the user created a hard-link to the device node,
+  * he can't use it any longer, because he lost permission
+  * to do so.
+  */
+static int secure_unlink(const char *filename)
+{
+	int retval;
+
+	retval = chown(filename, 0, 0);
+	if (retval) {
+		dbg("chown(%s, 0, 0) failed with error '%s'",
+		    filename, strerror(errno));
+		/* We continue nevertheless.
+		 * I think it's very unlikely for chown
+		 * to fail here, if the file exists.
+		 */
+	}
+	retval = chmod(filename, 0000);
+	if (retval) {
+		dbg("chmod(%s, 0000) failed with error '%s'",
+		    filename, strerror(errno));
+		/* We continue nevertheless. */
+	}
+	retval = unlink(filename);
+	if (errno == ENOENT)
+		retval = 0;
+	if (retval) {
+		dbg("unlink(%s) failed with error '%s'",
+			filename, strerror(errno));
+	}
+	return retval;
+}
+
 static int delete_node(struct udevice *dev)
 {
 	char filename[NAME_SIZE];
@@ -80,14 +114,9 @@ static int delete_node(struct udevice *dev)
 	strfieldcat(filename, dev->name);
 
 	info("removing device node '%s'", filename);
-	retval = unlink(filename);
-	if (errno == ENOENT)
-		retval = 0;
-	if (retval) {
-		dbg("unlink(%s) failed with error '%s'",
-			filename, strerror(errno));
+	retval = secure_unlink(filename);
+	if (retval)
 		return retval;
-	}
 
 	/* remove partition nodes */
 	if (dev->partitions > 0) {
@@ -95,7 +124,7 @@ static int delete_node(struct udevice *dev)
 		for (i = 1; i <= dev->partitions; i++) {
 			strfieldcpy(partitionname, filename);
 			strintcat(partitionname, i);
-			unlink(partitionname);
+			secure_unlink(partitionname);
 		}
 	}
 
@@ -130,29 +159,32 @@ static int delete_node(struct udevice *dev)
  * something different from the kernel name.  If we have, us it.  If not, use
  * the default kernel name for lack of anything else to know to do.
  */
-int udev_remove_device(char *path, char *subsystem)
+int udev_remove_device(const char *path, const char *subsystem)
 {
 	struct udevice dev;
 	char *temp;
 	int retval;
 
-	memset(&dev, 0, sizeof(dev));
+	memset(&dev, 0x00, sizeof(dev));
 
 	retval = udevdb_get_dev(path, &dev);
-	if (retval) {
+	if (retval != 0) {
 		dbg("'%s' not found in database, falling back on default name", path);
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
 		strfieldcpy(dev.name, &temp[1]);
 	}
+	dbg("name='%s'", dev.name);
 
-	dbg("name is '%s'", dev.name);
+	dev.type = get_device_type(path, subsystem);
+	dev_d_send(&dev, subsystem, path);
 	udevdb_delete_dev(path);
 
-	dev_d_send(&dev, subsystem);
-	sysbus_send_remove(dev.name, path);
+	if (dev.type == 'b' || dev.type == 'c')
+		retval = delete_node(&dev);
+	else if (dev.type == 'n')
+		retval = 0;
 
-	retval = delete_node(&dev);
 	return retval;
 }