Fix: sessiond: TOCTOU error on save of session configuration

[lttng-tools.git] / src / bin / lttng-sessiond / save.c

diff --git a/src/bin/lttng-sessiond/save.c b/src/bin/lttng-sessiond/save.c
index 489446d6311dc4d8048f5f525cf91fcab1e7eaa9..43e76c0b60df13f7fa2ec725c2f22b9d5eb8e2c1 100644 (file)
--- a/src/bin/lttng-sessiond/save.c
+++ b/src/bin/lttng-sessiond/save.c
@@ -104,6 +104,26 @@ int save_kernel_channel_attributes(struct config_writer *writer,
        if (ret) {
                goto end;
        }
+
+       if (attr->extended.ptr) {
+               struct lttng_channel_extended *ext = NULL;
+
+               ext = (struct lttng_channel_extended *) attr->extended.ptr;
+               ret = config_writer_write_element_unsigned_int(writer,
+                               config_element_monitor_timer_interval,
+                               ext->monitor_timer_interval);
+               if (ret) {
+                       goto end;
+               }
+
+               ret = config_writer_write_element_signed_int(writer,
+                               config_element_blocking_timeout,
+                               ext->blocking_timeout);
+               if (ret) {
+                       goto end;
+               }
+       }
+
 end:
        return ret ? LTTNG_ERR_SAVE_IO_FAIL : 0;
 }
@@ -113,6 +133,7 @@ int save_ust_channel_attributes(struct config_writer *writer,
        struct lttng_ust_channel_attr *attr)
 {
        int ret;
+       struct ltt_ust_channel *channel = NULL;
 
        ret = config_writer_write_element_string(writer,
                config_element_overwrite_mode,
@@ -156,6 +177,26 @@ int save_ust_channel_attributes(struct config_writer *writer,
        if (ret) {
                goto end;
        }
+
+       ret = config_writer_write_element_signed_int(writer,
+                       config_element_blocking_timeout,
+                       attr->u.s.blocking_timeout);
+       if (ret) {
+               goto end;
+       }
+
+       /*
+        * Fetch the monitor timer which is located in the parent of
+        * lttng_ust_channel_attr
+        */
+       channel = caa_container_of(attr, struct ltt_ust_channel, attr);
+       ret = config_writer_write_element_unsigned_int(writer,
+               config_element_monitor_timer_interval,
+               channel->monitor_timer_interval);
+       if (ret) {
+               goto end;
+       }
+
 end:
        return ret ? LTTNG_ERR_SAVE_IO_FAIL : 0;
 }
@@ -174,13 +215,13 @@ const char *get_kernel_instrumentation_string(
                instrumentation_string = config_event_type_tracepoint;
                break;
        case LTTNG_KERNEL_KPROBE:
-               instrumentation_string = config_event_type_kprobe;
+               instrumentation_string = config_event_type_probe;
                break;
        case LTTNG_KERNEL_FUNCTION:
-               instrumentation_string = config_event_type_function;
+               instrumentation_string = config_event_type_function_entry;
                break;
        case LTTNG_KERNEL_KRETPROBE:
-               instrumentation_string = config_event_type_kretprobe;
+               instrumentation_string = config_event_type_function;
                break;
        case LTTNG_KERNEL_NOOP:
                instrumentation_string = config_event_type_noop;
@@ -708,7 +749,11 @@ int init_ust_event_from_agent_event(struct ltt_ust_event *ust_event,
 
        ust_event->enabled = agent_event->enabled;
        ust_event->attr.instrumentation = LTTNG_UST_TRACEPOINT;
-       strncpy(ust_event->attr.name, agent_event->name, LTTNG_SYMBOL_NAME_LEN);
+       if (lttng_strncpy(ust_event->attr.name, agent_event->name,
+                       LTTNG_SYMBOL_NAME_LEN)) {
+               ret = -1;
+               goto end;
+       }
        switch (agent_event->loglevel_type) {
        case LTTNG_EVENT_LOGLEVEL_ALL:
                ust_loglevel_type = LTTNG_UST_LOGLEVEL_ALL;
@@ -1845,13 +1890,13 @@ static
 int save_session(struct ltt_session *session,
        struct lttng_save_session_attr *attr, lttng_sock_cred *creds)
 {
-       int ret, fd;
-       unsigned int file_opened = 0;   /* Indicate if the file has been opened */
-       char config_file_path[PATH_MAX];
+       int ret, fd = -1;
+       char config_file_path[LTTNG_PATH_MAX];
        size_t len;
        struct config_writer *writer = NULL;
        size_t session_name_len;
        const char *provided_path;
+       int file_open_flags = O_CREAT | O_WRONLY | O_TRUNC;
 
        assert(session);
        assert(attr);
@@ -1875,7 +1920,7 @@ int save_session(struct ltt_session *session,
                        ret = LTTNG_ERR_SET_URL;
                        goto end;
                }
-               strncpy(config_file_path, provided_path, len);
+               strncpy(config_file_path, provided_path, sizeof(config_file_path));
        } else {
                ssize_t ret_len;
                char *home_dir = utils_get_user_home_dir(
@@ -1919,27 +1964,34 @@ int save_session(struct ltt_session *session,
         * was done just above.
         */
        config_file_path[len++] = '/';
-       strncpy(config_file_path + len, session->name, session_name_len);
+       strncpy(config_file_path + len, session->name, sizeof(config_file_path) - len);
        len += session_name_len;
        strcpy(config_file_path + len, DEFAULT_SESSION_CONFIG_FILE_EXTENSION);
        len += sizeof(DEFAULT_SESSION_CONFIG_FILE_EXTENSION);
        config_file_path[len] = '\0';
 
-       if (!access(config_file_path, F_OK) && !attr->overwrite) {
-               /* File exists, notify the user since the overwrite flag is off. */
-               ret = LTTNG_ERR_SAVE_FILE_EXIST;
-               goto end;
+       if (!attr->overwrite) {
+               file_open_flags |= O_EXCL;
        }
 
-       fd = run_as_open(config_file_path, O_CREAT | O_WRONLY | O_TRUNC,
+       fd = run_as_open(config_file_path, file_open_flags,
                S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP,
                LTTNG_SOCK_GET_UID_CRED(creds), LTTNG_SOCK_GET_GID_CRED(creds));
        if (fd < 0) {
                PERROR("Could not create configuration file");
-               ret = LTTNG_ERR_SAVE_IO_FAIL;
+               switch (errno) {
+               case EEXIST:
+                       ret = LTTNG_ERR_SAVE_FILE_EXIST;
+                       break;
+               case EACCES:
+                       ret = LTTNG_ERR_EPERM;
+                       break;
+               default:
+                       ret = LTTNG_ERR_SAVE_IO_FAIL;
+                       break;
+               }
                goto end;
        }
-       file_opened = 1;
 
        writer = config_writer_create(fd, 1);
        if (!writer) {
@@ -2044,11 +2096,18 @@ end:
        }
        if (ret) {
                /* Delete file in case of error */
-               if (file_opened && unlink(config_file_path)) {
+               if ((fd >= 0) && unlink(config_file_path)) {
                        PERROR("Unlinking XML session configuration.");
                }
        }
 
+       if (fd >= 0) {
+               ret = close(fd);
+               if (ret) {
+                       PERROR("Closing XML session configuration");
+               }
+       }
+
        return ret;
 }