File tree Expand file tree Collapse file tree 2 files changed +18
-4
lines changed Expand file tree Collapse file tree 2 files changed +18
-4
lines changed Original file line number Diff line number Diff line change @@ -1757,19 +1757,25 @@ unix.Chroot (C)
17571757Check improper use of chroot described by SEI Cert C recommendation `POS05-C.
17581758Limit access to files by creating a jail
17591759<https://wiki.sei.cmu.edu/confluence/display/c/POS05-C.+Limit+access+to+files+by+creating+a+jail> `_.
1760- The checker finds usage patterns where chdir () is not called immediately
1761- after a call to chroot () .
1760+ The checker finds usage patterns where `` chdir("/") `` is not called immediately
1761+ after a call to `` chroot(path) `` .
17621762
17631763.. code-block :: c
17641764
17651765 void f();
17661766
1767- void test () {
1767+ void test_bad () {
17681768 chroot("/usr/local");
17691769 f(); // warn: no call of chdir("/") immediately after chroot
17701770 }
17711771
1772- void test() {
1772+ void test_bad_path() {
1773+ chroot("/usr/local");
1774+ chdir("/usr"); // warn: no call of chdir("/") immediately after chroot
1775+ f();
1776+ }
1777+
1778+ void test_good() {
17731779 chroot("/usr/local");
17741780 chdir("/"); // no warning
17751781 f();
Original file line number Diff line number Diff line change @@ -58,3 +58,11 @@ void f7(void) {
5858 // expected-note@-2 {{No call of chdir("/") immediately after chroot}}
5959 }
6060}
61+
62+ void f8 () {
63+ chroot ("/usr/local" ); // expected-note {{chroot called here}}
64+ chdir ("/usr" ); // This chdir was ineffective because it's not exactly `chdir("/")`.
65+ foo ();
66+ // expected-warning@-1 {{No call of chdir("/") immediately after chroot}}
67+ // expected-note@-2 {{No call of chdir("/") immediately after chroot}}
68+ }
You can’t perform that action at this time.
0 commit comments