tlshd: Fix a minor race

Parfait complains about using a pathname to perform an access(2)
and then passing the same pathname to open(2). Between the access(2)
and the open(2) calls, the permissions can change. I think this is
harmless for tlshd, but all the same, let's clean this up.

Signed-off-by: Chuck Lever <[email protected]>

Author: chucklever

src/tlshd/config.c

@@ -140,7 +140,11 @@ static bool tlshd_config_read_datum(const char *pathname, gnutls_datum_t *data,
 
 	fd = open(pathname, O_RDONLY);
 	if (fd == -1) {
-		tlshd_log_perror("open");
+		if (access(pathname, F_OK))
+			tlshd_log_debug("tlshd cannot access \"%s\"",
+					pathname);
+		else
+			tlshd_log_perror("open");
 		goto out;
 	}
 	if (fstat(fd, &statbuf)) {
@@ -198,7 +202,7 @@ bool tlshd_config_get_client_truststore(char **bundle)
 		g_error_free(error);
 		return false;
 	} else if (access(pathname, F_OK)) {
-		tlshd_log_debug("client x509.truststore pathname \"%s\" is not accessible", pathname);
+		tlshd_log_debug("tlshd cannot access \"%s\"", pathname);
 		g_free(pathname);
 		return false;
 	}
@@ -234,10 +238,6 @@ bool tlshd_config_get_client_certs(gnutls_pcert_st *certs,
 	if (!pathname) {
 		g_error_free(error);
 		return false;
-	} else if (access(pathname, F_OK)) {
-		tlshd_log_debug("client x509.certificate pathname \"%s\" is not accessible", pathname);
-		g_free(pathname);
-		return false;
 	}
 
 	if (!tlshd_config_read_datum(pathname, &data, TLSHD_OWNER,
@@ -282,10 +282,6 @@ bool tlshd_config_get_client_privkey(gnutls_privkey_t *privkey)
 	if (!pathname) {
 		g_error_free(error);
 		return false;
-	} else if (access(pathname, F_OK)) {
-		tlshd_log_debug("client x509.private_key pathname \"%s\" is not accessible", pathname);
-		g_free(pathname);
-		return false;
 	}
 
 	if (!tlshd_config_read_datum(pathname, &data, TLSHD_OWNER,
@@ -336,7 +332,7 @@ bool tlshd_config_get_server_truststore(char **bundle)
 		g_error_free(error);
 		return false;
 	} else if (access(pathname, F_OK)) {
-		tlshd_log_debug("server x509.truststore pathname \"%s\" is not accessible", pathname);
+		tlshd_log_debug("tlshd cannot access \"%s\"", pathname);
 		g_free(pathname);
 		return false;
 	}
@@ -372,10 +368,6 @@ bool tlshd_config_get_server_certs(gnutls_pcert_st *certs,
 	if (!pathname) {
 		g_error_free(error);
 		return false;
-	} else if (access(pathname, F_OK)) {
-		tlshd_log_debug("server x509.certificate pathname \"%s\" is not accessible", pathname);
-		g_free(pathname);
-		return false;
 	}
 
 	if (!tlshd_config_read_datum(pathname, &data, TLSHD_OWNER,
@@ -420,10 +412,6 @@ bool tlshd_config_get_server_privkey(gnutls_privkey_t *privkey)
 	if (!pathname) {
 		g_error_free(error);
 		return false;
-	} else if (access(pathname, F_OK)) {
-		tlshd_log_debug("server x509.privkey pathname \"%s\" is not accessible", pathname);
-		g_free(pathname);
-		return false;
 	}
 
 	if (!tlshd_config_read_datum(pathname, &data, TLSHD_OWNER,