|
|
|
|
|
|
access()
|
int access(const char *path, in mode)
|
AVOID
|
The information this function provides is outdated by the time you receive it.
Using the access() function followed by the
open() function causes a race condition that cannot be
solved.
|
Open the file with the permissions of the intended user.
|
|
bcopy()
|
void bcopy(const void *s1, void *s2, size_t n) void *memcpy(void *s1,
const void *s2, size_t n)
|
USE WITH CAUTION
|
Should not be used for copying strings, even though the length is known. Instead,
use the strlcpy() function.
|
NA
|
|
catopen()
|
nl_catd catopen(const char *name, int oflag)
|
USE WITH CAUTION
|
Libraries and programs should not call the catopen() function
on user-supplied pathnames. User-supplied message catalogues can be leveraged to break
privileged code easily.
|
NA
|
|
cftime()
|
int cftime(char *s, char *format, const time_t *clock)
int ascftime(char *s, const char *format, const struct tm
*timeptr)
|
UNSAFE
|
These functions do not check for bounds on the output buffer and might import the
user data through the CFTIME environment variable.
|
strftime(buf, sizeof (buf), fmt, &tm)
|
|
chdir()
|
int chdir(const char *path)
|
USE WITH CAUTION
|
Prone to pathname race conditions. Do not use in multithreaded programs.
|
To avoid the race condition, use the fchdir() function after
the directory has been opened and the properties have been checked using the
fstat() function). Oracle Solaris 11 has added the POSIX 2008
*at() versions of the system calls that operate on files such as
openat(), linkat(),
mkdirat(), mkfifoat(),
readlinkat(), and symlinkat(). These calls take
the file descriptor of a directory as the first argument to use as the working
directory for relative paths. These methods avoid the race condition when one thread
calls chdir() while another is calling open(),
unlink() and the like.
|
|
chmod()
|
int chmod(const char *path, mode_t mode)
int fchmodat(int fd, const char *path, mode_t mode, int
flag)
int chown(const char *path, uid_t owner, gid_t group)
int lchown(const char *path, uid_t owner, gid_t group)
|
AVOID
|
These functions operate on pathnames and are prone to race conditions. Normally,
programs need not call chown() or chmod(), but
honor the current UID (switch back to it before opening files) and
umask. Note that chmod() always follows symbolic links.
|
If the attributes of a file must be changed, open the file safely and use the
fchown() or the fchmod() functions on the
resulting file descriptor.
|
|
chroot()
|
int chroot(const char *path)
|
USE WITH CAUTION
|
After the chroot() function is called, the environment in which
it is called offers little protection. Programs can easily escape. Do not run
privileged programs in such a environment and that you change the directory to a point
below the new root after the chroot() function.
|
Run in a non-global zone.
|
|
copylist()
|
char *copylist(const char *filenm, off_t *szptr)
DBM *dbm_open(const char *file, int open_flags, mode_t
file_mode)
int dbminit(char *file)
|
USE WITH CAUTION
|
Used to open files and should only be used to open pathnames known to be
safe.
|
NA
|
|
dlopen()
|
void *dlopen(const char *pathname, int mode)
|
USE WITH CAUTION
|
Parameters passed to the dlopen() function should only be
unqualified pathnames which are then found using the runtime linker's path, or full
pathnames not in any way derived from user input (including from argv[0] ). There is
no way to safely open a user-supplied shared object. The object's
_init() function is run before dlopen()
returns.
|
NA
|
|
drand48()
|
double drand48(void)
double erand48(unsigned short xi[3])
long lrand48(void)long mrand48(void)
long jrand48(unsigned short xi[3])
long nrand48(unsigned short xi[3])
void srand48(long seedval)
int rand(void)
int rand_r(unsigned int *seed)
void srand(unsigned int seed)
long random(void)
|
AVOID
|
To generate random numbers for security or cryptography, use the getrandom() function.
|
NA
|
|
dup()
|
int dup(int fildes)
int dup2(int fildes, int fildes2)
|
USE WITH CAUTION
|
Both the dup() and the dup2() functions
return file descriptors with the FD_CLOEXEC cleared and therefore
they might leak when a program calls exec(). Older code made
fcntl() calls shortly after these functions returned to set that
flag. But in multithreaded code (including programs that only run one thread
themselves but may be linked with libraries that run additional threads), that leaves
a window open for a race with another thread. The F_DUPFD_CLOEXEC
and F_DUP2FD_CLOEXE calls to fcntl (available in Oracle Solaris 11 and
later releases) combine the duplication and flag setting into an atomic operation so
there is no race.
|
fcntl(fildes, F_DUPFD_CLOEXEC, 0)
fcntl(fildes, F_DUP2FD_CLOEXEC, fildes2)
|
|
execl()
|
int execl(const char *path, const char *arg0, ..., const char *argn,
NULL)
int execv(const char *path, char *const argv[])
int execve(const char *path, char *const argv[], char *const
envp[])
|
USE WITH CAUTION
|
Make sure that the environment is sanitized and non-essential file descriptors are
closed before running a new program.
|
NA
|
|
execvp()
|
int execvp(const char *file, const char *argv[])
int execlp(const char *file, const char *arg0, ..., const char *argn,
NULL)
|
AVOID
|
Too dangerous to use in libraries or privileged commands and daemons because they
find the executable by searching the directories in the PATH
environment variable, which is under the complete control of the user. They should be
avoided for most other programs.
|
Use the execl(), execv(), or
execve() functions.
|
|
fattach()
|
int fattach(int filedes, const char *path)
|
USE WITH CAUTION
|
Check the file descriptor after the open() function (using
fstat()), and not the pathname before the open()
function.
|
NA
|
|
fchmod()
|
int fchmod(int filedes, mode_t mode)
int fchown(int filedes, uid_t owner, gid_t group)
|
UNRESTRICTED
|
Preferred alternative to chmod() and chown()
functions.
|
NA
|
|
fdopen()
|
FILE *fdopen(int filedes, const char *mode)
|
UNRESTRICTED
|
Alternative for fopen()
|
NA
|
|
fopen()
|
FILE *fopen(const char *path, const char *mode)
FILE *freopen(const char *path, const char *mode, FILE *stream)
|
USE WITH CAUTION
|
It is not possible to safely create files by using fopen().
However, once a pathname is verified to exist, that is, after calling the
mkstemp() function, it can be used to open those pathnames. In
other cases, a safe invocation of open() followed by
fdopen() should be used.
|
Use open() followed by fdopen(), For
example:
FILE *fp; int fd;
fd = open(path,
O_CREAT|O_EXCL|O_WRONLY,
0600);
if (fd < 0){
...... }
fp = fdopen(fd, "w");
|
|
fstat()
|
int fstat(int filedes, struct stat *buf)
|
UNRESTRICTED
|
Useful to check whether the file that is opened is the file you expected to
open.
|
NA
|
|
ftw()
|
int ftw(const char *path, int (*fn)(), int depth)
int nftw(const char *path, int (*fn)(), int depth, int
flags)
|
USE WITH CAUTION
|
Follows symbolic links and crosses mount points.
|
Use nftw with the appropriate flags set (a combination of
FTW_PHYS and FTW_MOUNT).
|
|
getenv()
|
char *getenv(const char *name)
|
USE WITH CAUTION
|
The environment is completely user-specified. If possible, avoid the use of
getenv() in libraries. Strings returned by
getenv() can be up to NCARGS bytes long
(currently 1MB for 32-bit environments). Pathnames derived from environment variables
should not be trusted. They should not be used as input for any of the
*open() functions (including catopen() and
dlopen()).
|
NA
|
|
getlogin()
|
char *getlogin(void)
|
AVOID
|
The value returned by getlogin() is not reliable. It is only a
hint for the user name.
|
NA
|
|
getpass()
|
char *getpass(const char *prompt)
|
AVOID
|
Only the first 8 bytes of input are used. Avoid using it in new code.
|
Use the getpassphrase() function.
|
|
gets()
|
char *gets(char *s)
|
UNSAFE
|
This function does not check for bounds when storing the input. This function
cannot be used securely.
|
Use fgets(buf, sizeof (buf), stdin) OR getline(buf,
bufsize, stdin).
The getline(buf, bufsize, stdin) function is new in Oracle Solaris
11.
|
|
kvm_open()
|
kvm_t *kvm_open(char *namelist, char *corefile, char *swapfile, int flag,
char *errstr)
int nlist(const char *filename, struct nlist *nl)
|
AVOID
|
Write a proper kstat or other interface if you need information from the kernel.
If you accept a user-specified namelist argument, make sure you revoke privileges
before using it. Otherwise, a specifically constructed namelist can be used to read
random parts of the kernel, revealing possibly sensitive data.
|
NA
|
|
lstat()
|
int lstat(const char *path, struct stat *buf)
int stat(const char *path, struct stat *buf)
int fstatat(int fildes, const char *path, struct stat *buf, int
flag)
|
USE WITH CAUTION
|
Do not use these functions to check for the existence or absence of a file. The
lstat(), stat(), or fstatat()
functions followed by open() have an inherent race
condition.
|
If the purpose is to create the file that does not exist, use
open(file, O_CREAT|O_EXCL, mode)
If the purpose is to read the file, open it for reading. If the purpose is to make
sure the file attributes are correct before reading from it, use
fd = open(file, O_RDONLY); fstat(fd, &statbuf);
If the pathname can't be trusted, add O_NONBLOCK to the open
flags. This prevents the application from freezing upon opening a device.
|
|
mkdir()
|
int mkdir(const char *path, mode_t mode)
int mkdirat(int fd, const char *path, mode_t mode)
int mknod(const char *path, mode_t mode, dev_t dev)
int mknodat(int fd, const char *path, mode_t mode, dev_t
dev)
|
USE WITH CAUTION
|
Be careful about the path used. These functions will not follow symbolic links for
the last component and hence they are relatively safe.
|
NA
|
|
mkstemp()
|
int mkstemp(char *template)
|
UNRESTRICTED
|
Safe temporary file creation function.
|
NA
|
|
mktemp()
|
char *mktemp(char *template)
|
AVOID
|
Generates a temporary filename but the use of the generated pathname is not
guaranteed safe because there is a race condition between the checks in
mktemp() and the subsequent call to open() by
the application.
|
Use mkstemp() to create a file and mkdtemp()
to create a directory.
|
|
open()
|
int open(const char *path, int oflag, /* mode_t mode
*/...)
int creat(const char *path, mode_t mode)
|
USE WITH CAUTION
|
When opening for reading from a privileged program, make sure that you open the
file as a user by dropping privileges or setting the effective UID
to the real UID. Under no circumstances should programs implement
their own access control based on file ownership and modes. Similarly, when creating
files, do not open and then use chown() on the file.
When opening for writing, the program can be tricked into opening the wrong file
by following symbolic or hard links. To avoid this problem, either use the
O_NOFOLLOW and O_NOLINKS flags, or use
O_CREAT|O_EXCL to ensure that a new file is created instead of
opening an existing file.
When opening a file, consider whether the file descriptor should be kept open
across an exec() call. In Oracle Solaris 11, you can specify
O_CLOEXEC in the open flags to atomically mark the file descriptor
to be closed by exec system calls. In older releases, you must use the
fcntl() function with the FD_CLOEXEC flag, which
allows a race condition in multithreaded programs, if another thread forks and runs
between the open() and fcntl() calls.
|
NA
|
|
popen()
|
FILE *popen(const char *command, const char *mode)
int p2open(const char *cmd, FILE *fp[2])
int system(const char *string)
|
AVOID
|
These three library calls always involve the shell which involves PATH, IFS, other
environment variables and interpretation of special characters. Refer CERT
C Coding Recommendation ENV04-C for more details.
|
Use posix_spawn() to run other programs, with
waitpid() or pipe() as necessary.
|
|
printf()
|
int printf(const char *format, ...)
int vprintf(const char *format, va_list ap)
int fprintf(FILE *stream, const char *format, ...)
int vfprintf(FILE *stream, const char *format, va_list
ap)
int snprintf(char *s, size_t n, const char *format, ...)
int vsnprintf(char *s, size_t n, const char *format, va_list
ap)
int wprintf(const wchar_t *format, ...)
int vwprintf(const wchar_t format, va_list arg)
int fwprintf(FILE *stream, const wchar_t *format, ...)
int vfwprintf(FILE *stream, const wchar_t *format, va_list
arg)
int swprintf(wchar_t *s, size_t n, const wchar_t *format,
...)
int vswprintf(wchar_t *s, size_t n, const wchar_t *format, va_list
arg)
int asprintf(char **ret, const char *format, ...)
|
USE WITH CAUTION
|
At risk from user-specified format strings. If the format string comes from a
message catalog, verify your NLSPATH manipulations and
catopen() or catget() uses. The C library tries
to be safe by ignoring NLSPATH settings for setuid and setgid
applications.
|
The snprintf() and vsnprintf() functions
return the number of characters that would have been written to the buffer if it were
large enough. You cannot use this value in constructs like, p += snprintf(p,
lenp, "...") because p might point beyond p+lenp afterwards.
|
|
scanf()
|
int scanf(const char *format, ...)
int vscanf(const char *format, va_list arg)
int fscanf(FILE *stream, const char *format, ...)
int vfscanf(FILE *stream, const char *format, va_list
arg)
int sscanf(const char *s, const char *format, ...)
int vsscanf(const char *s, const char *format, va_list
arg)
|
USE WITH CAUTION
|
When scanning strings, make sure the format specified includes maximum buffer
lengths. Use scanf("%10s", p) to limit scanf()
to read 10 characters at most. Note that the corresponding buffer must be at least
eleven bytes to allow space for the terminating NULL
character.
|
NA
|
|
sprintf()
|
int sprintf(char *s, const char *fmt, ...)
int vsprintf(char *s, const char *fmt, va_list ap)
|
AVOID
|
Typically cause buffer overflow. If you must use these functions, make sure that
the fmt argument cannot be user-controlled and that you can trust the parameters not
to overflow the destination buffer.
|
Use snprintf(), vsnprintf() or
asprintf(). The asprintf() function is new in
Oracle Solaris 11.
|
|
strcat()
|
char *strcat(char *s1, const char *s2)
char *strcpy(char *s1, const char *s2)
|
AVOID
|
It is not possible to limit these functions to a maximum buffer size. However, you
can calculate the amount of space required before calling strcat or strcpy. Use of
these functions always forces reviewers to follow the logic, and prevent automated
scanning of source code for vulnerabilities.
|
strlcat(dst, src, dstsize)
strlcpy(dst, src, dstsize)
|
|
strccpy()
|
char *strccpy(char *output, const char *input)
char *strcadd(char *output, const char *input)
char *streadd(char *output, const char *input)
char *strecpy(char *output, const char *input, const char
*exceptions)
char *strtrns(const char *string, const char *old, const char *new, char
*result)
|
USE WITH CAUTION
|
Similar problems as with strcpy(). See the strcpy and strccpy
man pages for proper use.
|
NA
|
|
strlcpy()
|
size_t strlcpy(char *dst, const char *src, size_t
dstsize)
size_t strlcat(char *dst, const char *src, size_t
dstsize)
|
UNRESTRICTED
|
Preferred alternative to the strcpy() and the
strcat() functions. Available in Solaris 8 and later. Should be
used with constant and not computed size arguments to facilitate code review.
|
NA
|
|
strncat()
|
char *strncat(char *s1, const char *s2, size_t n)
char *strncpy(char *s1, const char *s2, size_t n)
|
USE WITH CAUTION
|
The strncpy() function is not guaranteed to null-terminate the
destination buffer. The strncat() function is hard to use as it
requires the proper size of the destination buffer to be calculated.
The fact that the strncpy() function does not null- terminate
on insufficient space, together with the side effect that it will add
NULL bytes if there is space left, makes it
a useful function for updating structures that reside on disk. For
example, the wtmpx files, are often generated with write (fd, w, sizeof
(*w));
|
strlcpy(dst, src, dstsize)
strlcat(dst, src, dstsize)
|
|
syslog()
|
void syslog(int priority, const char *message, ...)
void vsyslog(int priority, const char *message, va_list
ap)
|
USE WITH CAUTION
|
At risk from user-specified format strings. Verify your NLSPATH
manipulations and catopen() or catget()
uses.
|
NA
|
|
tempnam()
|
char *tempnam(const char *dir, const char *pfx)
char *tmpnam(char *s)
char *tmpnam_r(char *s)
|
AVOID
|
These functions are not suitable for generating unpredictable filenames. There is
a race condition between the generation of the filename and its use, for example,
open().
|
mkstem()
|
|
tmpfile()
|
FILE *tmpfile(void)
|
USE WITH CAUTION
|
Uses mkstemp(), so it is safe to use. However, because this
function changes the umask, it is not multithread safe.
|
NA
|
|
truncate()
|
int truncate(const char *path, off_t length)
|
AVOID
|
This function is prone to pathname race conditions.
|
Use ftruncate() after a safe open().
|
|
umask()
|
mode_t umask(mode_t cmask)
|
USE WITH CAUTION
|
Should not be used in libraries or applications; the user's umask should be used.
Also it is not multithread safe.
|
NA
|
|
utmpname()
|
int utmpname(const char *file) int utmpxname(const char *file)
|
AVOID
|
Use the default utmp and utmpx
files.
|
NA
|
|
wordexp()
|
int wordexp(const char *restrict words, wordexp_t *restrict pwordexp, int
flags)
|
USE WITH CAUTION
|
wordexp() passes the input string to a shell for expansion.
Input provided by untrusted sources may attempt to use shell injection attacks to run
additional commands.
|
If only wildcard expansion is required, use the glob()
function.
|