Function do_mkdir_at

syscall.c:1031–1076

Symlink-race-safe variant of do_mkdir() for receiver-side use. See the comment on do_chmod_at() for the threat model and design rationale. mkdir() resolves parent symlinks at every component, so a parent- component swap can place an attacker-named directory outside the module. Defence: open the parent of fname under secure_relative_open() and call mkdirat() against that dirfd. Mutate

  parent and absolute-path cases.
*/
int do_mkdir_at(char *path, mode_t mode)
{
#ifdef AT_FDCWD
	extern int am_daemon, am_chrooted;
	char dirpath[MAXPATHLEN];
	const char *bname;
	const char *slash;
	int dfd, ret, e;
	size_t dlen;

	if (dry_run) return 0;
	RETURN_ERROR_IF_RO_OR_LO;
	trim_trailing_slashes(path);

	if (!am_daemon || am_chrooted)
		return mkdir(path, mode);

	if (!path || !*path || *path == '/')
		return mkdir(path, mode);

	slash = strrchr(path, '/');
	if (!slash)
		return mkdir(path, mode);

	dlen = slash - path;
	if (dlen >= sizeof dirpath) {
		errno = ENAMETOOLONG;
		return -1;
	}
	memcpy(dirpath, path, dlen);
	dirpath[dlen] = '\0';
	bname = slash + 1;

	dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
	if (dfd < 0)
		return -1;

	ret = mkdirat(dfd, bname, mode);
	e = errno;
	close(dfd);
	errno = e;
	return ret;
#else
	return do_mkdir(path, mode);
#endif
}

/* like mkstemp but forces permissions */
int do_mkstemp(char *template, mode_t perms)