Skip to content

Replace use of access(2) in ocat(1) #539

@jpmens

Description

@jpmens

ocat is a setuid program which uses access(2) to verify accessibilty of the defaults file. I don't see how this hasn't surfaced previously, but that is an incorrect use:

The access() system call uses the real user ID in place of the effective user ID, the real group ID in place of the effective group ID, and the rest of the group access list.

I noticed this while tailing logs for #536

ocat: Skipping open defaults file /etc/default/ot-recorder: Permission denied

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions