From d7e0104ae4da25f455630aae044adf165201c9b5 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 10 Nov 2025 20:31:26 +0900 Subject: treewide: reject impossible user-supplied fd These are all trusted user input, however this check reduces the likelihood of hard to debug errors. Signed-off-by: Ophestra --- cmd/hakurei/parse.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'cmd') diff --git a/cmd/hakurei/parse.go b/cmd/hakurei/parse.go index 5362fffe..266eb47f 100644 --- a/cmd/hakurei/parse.go +++ b/cmd/hakurei/parse.go @@ -11,6 +11,7 @@ import ( "syscall" "hakurei.app/hst" + "hakurei.app/internal/outcome" "hakurei.app/internal/store" "hakurei.app/message" ) @@ -53,14 +54,23 @@ func tryFd(msg message.Msg, name string) io.ReadCloser { } return nil } else { + if v < 3 { // reject standard streams + return nil + } + msg.Verbosef("trying config stream from %d", v) fd := uintptr(v) if _, _, errno := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_GETFD, 0); errno != 0 { - if errors.Is(errno, syscall.EBADF) { + if errors.Is(errno, syscall.EBADF) { // reject bad fd return nil } log.Fatalf("cannot get fd %d: %v", fd, errno) } + + if outcome.IsPollDescriptor(fd) { // reject runtime internals + log.Fatalf("invalid config stream %d", fd) + } + return os.NewFile(fd, strconv.Itoa(v)) } } -- cgit v1.3.1