[Bug libc/15763] New: shm_open/unlink let you write outside SHMDIR

["corbellini.andrea at gmail dot com" <sourceware-bugzilla@sourceware.org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=15763

            Bug ID: 15763
           Summary: shm_open/unlink let you write outside SHMDIR
           Product: glibc
           Version: 2.18
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: corbellini.andrea at gmail dot com
                CC: drepper.fsp at gmail dot com

shm_open() and shm_unlink() accept relative paths. As the test case below
demonstrates, if you give a relative path to shm_open, you will be able to open
files anywhere in the system (assuming that you have the right permissions).

Test case:
#include <fcntl.h>
int main (void)
{
  shm_open ("../../tmp/abc", O_CREAT | O_RDWR, 0666);
  perror ("shm_open");
}

Expected output:
shm_open: Invalid argument

Actual output:
shm_open: Success

-- 
You are receiving this mail because:
You are on the CC list for the bug.