X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/6874238c54934b2797dd34cb3952ad90ab0e8e75..7d0cfe71cf84a7af4ea4f415964767dcb7d1dd66:/src/unix/snglinst.cpp diff --git a/src/unix/snglinst.cpp b/src/unix/snglinst.cpp index 24ba3328da..66d616c32a 100644 --- a/src/unix/snglinst.cpp +++ b/src/unix/snglinst.cpp @@ -18,7 +18,7 @@ // headers // ---------------------------------------------------------------------------- -#ifdef __GNUG__ +#if defined(__GNUG__) && !defined(NO_GCC_PRAGMA) #pragma implementation "snglinst.h" #endif @@ -180,6 +180,17 @@ LockResult wxSingleInstanceCheckerImpl::CreateLockFile() fsync(m_fdLock); + // change file's permission so that only this user can access it: + if ( chmod(m_nameLock.fn_str(), S_IRUSR | S_IWUSR) != 0 ) + { + wxLogSysError(_("Failed to set permissions on lock file '%s'"), + m_nameLock.c_str()); + + Unlock(); + + return LOCK_ERROR; + } + return LOCK_CREATED; } else // failure: see what exactly happened @@ -226,6 +237,26 @@ bool wxSingleInstanceCheckerImpl::Create(const wxString& name) return FALSE; } + // Check if the file is owned by current user and has 0600 permissions. + // If it doesn't, it's a fake file, possibly meant as a DoS attack, and + // so we refuse to touch it: + wxStructStat stats; + if ( wxStat(name, &stats) != 0 ) + { + wxLogSysError(_("Failed to inspect the lock file '%s'"), name.c_str()); + return false; + } + if ( stats.st_uid != getuid() ) + { + wxLogError(_("Lock file '%s' has incorrect owner."), name.c_str()); + return false; + } + if ( stats.st_mode != (S_IFREG | S_IRUSR | S_IWUSR) ) + { + wxLogError(_("Lock file '%s' has incorrect permissions."), name.c_str()); + return false; + } + // try to open the file for reading and get the PID of the process // which has it wxFile file(name, wxFile::read);