Mon 20 Jul 2015 08:27:17 AM UTC, original submission:
There is a race condition in screen creating the socket directories.
Both the main and the user specific directory (child to the main) suffer from the same type of race condition.
Taken from "screen.c" (version 4.1.0 of Ubuntu, but the same for 4.2), creating the child obviously got patched:
-----------
sprintf(SockPath, "%s/S-%s", SockDir, LoginName);
if (access(SockPath, F_OK))
{
if (mkdir(SockPath, 0700) == -1 && errno != EEXIST)
Panic(errno, "Cannot make directory '%s'", SockPath);
(void) chown(SockPath, real_uid, real_gid);
}
}
-----------
However a few lines up, creating the parent directory is still suffering from the race condition:
-----------
if (stat(SockDir, &st))
{
n = (eff_uid == 0 && (real_uid || eff_gid == real_gid)) ? 0755 :
(eff_gid != real_gid) ? 0775 :
#ifdef S_ISVTX
0777|S_ISVTX;
#else
0777;
#endif
// START: !!
if (mkdir(SockDir, n) == -1)
Panic(errno, "Cannot make directory '%s'", SockDir);
// END: !!
}
-----------
If the screen tool is started at the same time, then between the "stat" call and the "mkdir" call it may happen that that another instance of screen already created the directory. Causing the second "mkdir" to fail with "EEXIST". Which is "ok", since the directory simple has to be there.
|