Function private_log_directory_path_copy

src/daemon/ipc.c:1346–1380

}

static char *private_log_directory_path_copy(const char *directory_path) {
#ifdef __APPLE__
    /* Darwin exposes the trusted top-level aliases /tmp -> /private/tmp and
     * /var -> /private/var.  Resolve only those root-owned aliases before the
     * component-wise O_NOFOLLOW walk.  Canonicalizing the complete caller path
     * would follow an attacker-controlled cache/log symlink and is forbidden. */
    static const char *const aliases[] = {"/tmp", "/var"};
    for (size_t index = 0; index < sizeof(aliases) / sizeof(aliases[0]); index++) {
        const char *alias = aliases[index];
        size_t alias_length = strlen(alias);
        if (strncmp(directory_path, alias, alias_length) != 0 ||
            (directory_path[alias_length] != '\0' && directory_path[alias_length] != '/')) {
            continue;
        }
        struct stat alias_status;
        if (lstat(alias, &alias_status) != 0 || !S_ISLNK(alias_status.st_mode)) {
            break;
        }
        struct stat root_status;
        char resolved[CBM_DAEMON_IPC_PATH_CAP];
        if (alias_status.st_uid != 0 || lstat("/", &root_status) != 0 ||
            !S_ISDIR(root_status.st_mode) || root_status.st_uid != 0 ||
            (root_status.st_mode & 0022) != 0 || !realpath(alias, resolved)) {
            return NULL;
        }
        struct stat resolved_status;
        if (lstat(resolved, &resolved_status) != 0 || !S_ISDIR(resolved_status.st_mode) ||
            resolved_status.st_uid != 0) {
            return NULL;
        }
        return string_format("%s%s", resolved, directory_path + alias_length);
    }
#endif
    return string_copy(directory_path);
}

static bool posix_directory_owner_trusted(uid_t owner) {
    return owner == (uid_t)0 || owner == geteuid();