From: jiangjixiang The FIFO pipe path /tmp/ebtables-vX.Y.Z/ebtablesd_pipe is in a world-writable directory. A local unprivileged user can pre-place a symlink at this path. When ebtablesu is invoked by root, the open(O_WRONLY) call follows the symlink and overwrites an arbitrary pre-existing file. Adding O_NOFOLLOW makes open() fail with ELOOP if the last component of the path is a symbolic link, preventing the attack. Signed-off-by: jiangjixiang --- ebtablesu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ebtablesu.c b/ebtablesu.c index 3cee145..b1e0ec3 100644 --- a/ebtablesu.c +++ b/ebtablesu.c @@ -66,7 +66,7 @@ int main(int argc, char *argv[]) return -1; } - if ((writefd = open(EBTD_PIPE, O_WRONLY, 0)) == -1) { + if ((writefd = open(EBTD_PIPE, O_WRONLY | O_NOFOLLOW, 0)) == -1) { fprintf(stderr, "Could not open the pipe, perhaps ebtablesd is " "not running or you don't have write permission (try " "running as root).\n"); -- 2.55.0.windows.3