Fix: sessiond: TOCTOU error on save of session configuration

[lttng-tools.git] / src / bin / lttng-sessiond / save.c

diff --git a/src/bin/lttng-sessiond/save.c b/src/bin/lttng-sessiond/save.c
index 1a879b21429892e1f1af1465af9c790b5f7270b5..43e76c0b60df13f7fa2ec725c2f22b9d5eb8e2c1 100644 (file)
--- a/src/bin/lttng-sessiond/save.c
+++ b/src/bin/lttng-sessiond/save.c
@@ -104,6 +104,26 @@ int save_kernel_channel_attributes(struct config_writer *writer,
        if (ret) {
                goto end;
        }
+
+       if (attr->extended.ptr) {
+               struct lttng_channel_extended *ext = NULL;
+
+               ext = (struct lttng_channel_extended *) attr->extended.ptr;
+               ret = config_writer_write_element_unsigned_int(writer,
+                               config_element_monitor_timer_interval,
+                               ext->monitor_timer_interval);
+               if (ret) {
+                       goto end;
+               }
+
+               ret = config_writer_write_element_signed_int(writer,
+                               config_element_blocking_timeout,
+                               ext->blocking_timeout);
+               if (ret) {
+                       goto end;
+               }
+       }
+
 end:
        return ret ? LTTNG_ERR_SAVE_IO_FAIL : 0;
 }
@@ -113,6 +133,7 @@ int save_ust_channel_attributes(struct config_writer *writer,
        struct lttng_ust_channel_attr *attr)
 {
        int ret;
+       struct ltt_ust_channel *channel = NULL;
 
        ret = config_writer_write_element_string(writer,
                config_element_overwrite_mode,
@@ -156,6 +177,26 @@ int save_ust_channel_attributes(struct config_writer *writer,
        if (ret) {
                goto end;
        }
+
+       ret = config_writer_write_element_signed_int(writer,
+                       config_element_blocking_timeout,
+                       attr->u.s.blocking_timeout);
+       if (ret) {
+               goto end;
+       }
+
+       /*
+        * Fetch the monitor timer which is located in the parent of
+        * lttng_ust_channel_attr
+        */
+       channel = caa_container_of(attr, struct ltt_ust_channel, attr);
+       ret = config_writer_write_element_unsigned_int(writer,
+               config_element_monitor_timer_interval,
+               channel->monitor_timer_interval);
+       if (ret) {
+               goto end;
+       }
+
 end:
        return ret ? LTTNG_ERR_SAVE_IO_FAIL : 0;
 }
@@ -174,13 +215,13 @@ const char *get_kernel_instrumentation_string(
                instrumentation_string = config_event_type_tracepoint;
                break;
        case LTTNG_KERNEL_KPROBE:
-               instrumentation_string = config_event_type_kprobe;
+               instrumentation_string = config_event_type_probe;
                break;
        case LTTNG_KERNEL_FUNCTION:
-               instrumentation_string = config_event_type_function;
+               instrumentation_string = config_event_type_function_entry;
                break;
        case LTTNG_KERNEL_KRETPROBE:
-               instrumentation_string = config_event_type_kretprobe;
+               instrumentation_string = config_event_type_function;
                break;
        case LTTNG_KERNEL_NOOP:
                instrumentation_string = config_event_type_noop;
@@ -1849,13 +1890,13 @@ static
 int save_session(struct ltt_session *session,
        struct lttng_save_session_attr *attr, lttng_sock_cred *creds)
 {
-       int ret, fd;
-       unsigned int file_opened = 0;   /* Indicate if the file has been opened */
-       char config_file_path[PATH_MAX];
+       int ret, fd = -1;
+       char config_file_path[LTTNG_PATH_MAX];
        size_t len;
        struct config_writer *writer = NULL;
        size_t session_name_len;
        const char *provided_path;
+       int file_open_flags = O_CREAT | O_WRONLY | O_TRUNC;
 
        assert(session);
        assert(attr);
@@ -1879,7 +1920,7 @@ int save_session(struct ltt_session *session,
                        ret = LTTNG_ERR_SET_URL;
                        goto end;
                }
-               strncpy(config_file_path, provided_path, len);
+               strncpy(config_file_path, provided_path, sizeof(config_file_path));
        } else {
                ssize_t ret_len;
                char *home_dir = utils_get_user_home_dir(
@@ -1923,27 +1964,34 @@ int save_session(struct ltt_session *session,
         * was done just above.
         */
        config_file_path[len++] = '/';
-       strncpy(config_file_path + len, session->name, session_name_len);
+       strncpy(config_file_path + len, session->name, sizeof(config_file_path) - len);
        len += session_name_len;
        strcpy(config_file_path + len, DEFAULT_SESSION_CONFIG_FILE_EXTENSION);
        len += sizeof(DEFAULT_SESSION_CONFIG_FILE_EXTENSION);
        config_file_path[len] = '\0';
 
-       if (!access(config_file_path, F_OK) && !attr->overwrite) {
-               /* File exists, notify the user since the overwrite flag is off. */
-               ret = LTTNG_ERR_SAVE_FILE_EXIST;
-               goto end;
+       if (!attr->overwrite) {
+               file_open_flags |= O_EXCL;
        }
 
-       fd = run_as_open(config_file_path, O_CREAT | O_WRONLY | O_TRUNC,
+       fd = run_as_open(config_file_path, file_open_flags,
                S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP,
                LTTNG_SOCK_GET_UID_CRED(creds), LTTNG_SOCK_GET_GID_CRED(creds));
        if (fd < 0) {
                PERROR("Could not create configuration file");
-               ret = LTTNG_ERR_SAVE_IO_FAIL;
+               switch (errno) {
+               case EEXIST:
+                       ret = LTTNG_ERR_SAVE_FILE_EXIST;
+                       break;
+               case EACCES:
+                       ret = LTTNG_ERR_EPERM;
+                       break;
+               default:
+                       ret = LTTNG_ERR_SAVE_IO_FAIL;
+                       break;
+               }
                goto end;
        }
-       file_opened = 1;
 
        writer = config_writer_create(fd, 1);
        if (!writer) {
@@ -2048,12 +2096,12 @@ end:
        }
        if (ret) {
                /* Delete file in case of error */
-               if (file_opened && unlink(config_file_path)) {
+               if ((fd >= 0) && unlink(config_file_path)) {
                        PERROR("Unlinking XML session configuration.");
                }
        }
 
-       if (file_opened) {
+       if (fd >= 0) {
                ret = close(fd);
                if (ret) {
                        PERROR("Closing XML session configuration");