mkdir() and "Time of Check, Time of Use" vulnerabilities
Is there a secure altern开发者_如何学JAVAative to mkdir()
for C? I am examining some code and notice it is using calls to mkdir()
. From what I have read on the US-CERT Secure Coding site, use of that function leaves it vulnerable to "Time of Check, Time of Use" (TOCTOU).
Edit
From the miniunz.c source for zlib
int mymkdir(dirname)
const char* dirname;
{
int ret=0;
#ifdef WIN32
ret = mkdir(dirname);
#else
#ifdef unix
ret = mkdir (dirname,0775);
#endif
#endif
return ret;
}
The mkdir
above is what I am referring to.
Your question is a little vague; a reference to the US-CERT document and some sample code would be nice.
Nevertheless, I bet the answer is mkdirat().
mkdir()
is only TOCTOU - Time of Check, Time of Use when it's preceded by a check to see if the directory exists.
The usage above, in your example, is ok if the calling code does the right thing. Check Zack's comment.
精彩评论