| Commit message (Expand) | Author | Age | Files | Lines |
|---|
| * | avoid limited space of random temp file names if clock resolution is low•••this is not an issue that was actually hit, but I noticed it during
previous changes to __randname: if the resolution of tv_nsec is too
low, the space of temp file names obtainable by a thread could
plausibly be exhausted. mixing in tv_sec avoids this.
| Rich Felker | 2022-06-23 | 1 | -1/+1 |
| * | remove random filename obfuscation that leaks ASLR information•••the __randname function is used by various temp file creation
interfaces as a backend to produce a name to attempt using. it does
not have to produce results that are safe against guessing, and only
aims to avoid unintentional collisions.
mixing the address of an object on the stack in a reversible manner
leaked ASLR information, potentially allowing an attacker who can
observe the temp files created and their creation timestamps to narrow
down the possible ASLR state of the process that created them. there
is no actual value in mixing these addresses in; it was just
obfuscation. so don't do it.
instead, mix the tid, just to avoid collisions if multiple
processes/threads stampede to create temp files at the same moment.
even without this measure, they should not collide unless the clock
source is very low resolution, but it's a cheap improvement.
if/when we have a guaranteed-available userspace csprng, it could be
used here instead. even though there is no need for cryptographic
entropy here, it would avoid having to reason about clock resolution
and such to determine whether the behavior is nice.
| Rich Felker | 2022-06-03 | 1 | -1/+2 |
| * | remove spurious inclusion of libc.h for LFS64 ABI aliases•••the LFS64 macro was not self-documenting and barely saved any
characters. simply use weak_alias directly so that it's clear what's
being done, and doesn't depend on a header to provide a strange macro.
| Rich Felker | 2018-09-12 | 3 | -6/+3 |
| * | reduce spurious inclusion of libc.h•••libc.h was intended to be a header for access to global libc state and
related interfaces, but ended up included all over the place because
it was the way to get the weak_alias macro. most of the inclusions
removed here are places where weak_alias was needed. a few were
recently introduced for hidden. some go all the way back to when
libc.h defined CANCELPT_BEGIN and _END, and all (wrongly implemented)
cancellation points had to include it.
remaining spurious users are mostly callers of the LOCK/UNLOCK macros
and files that use the LFS64 macro to define the awful *64 aliases.
in a few places, new inclusion of libc.h is added because several
internal headers no longer implicitly include libc.h.
declarations for __lockfile and __unlockfile are moved from libc.h to
stdio_impl.h so that the latter does not need libc.h. putting them in
libc.h made no sense at all, since the macros in stdio_impl.h are
needed to use them correctly anyway.
| Rich Felker | 2018-09-12 | 1 | -1/+0 |
| * | overhaul internally-public declarations using wrapper headers•••commits leading up to this one have moved the vast majority of
libc-internal interface declarations to appropriate internal headers,
allowing them to be type-checked and setting the stage to limit their
visibility. the ones that have not yet been moved are mostly
namespace-protected aliases for standard/public interfaces, which
exist to facilitate implementing plain C functions in terms of POSIX
functionality, or C or POSIX functionality in terms of extensions that
are not standardized. some don't quite fit this description, but are
"internally public" interfacs between subsystems of libc.
rather than create a number of newly-named headers to declare these
functions, and having to add explicit include directives for them to
every source file where they're needed, I have introduced a method of
wrapping the corresponding public headers.
parallel to the public headers in $(srcdir)/include, we now have
wrappers in $(srcdir)/src/include that come earlier in the include
path order. they include the public header they're wrapping, then add
declarations for namespace-protected versions of the same interfaces
and any "internally public" interfaces for the subsystem they
correspond to.
along these lines, the wrapper for features.h is now responsible for
the definition of the hidden, weak, and weak_alias macros. this means
source files will no longer need to include any special headers to
access these features.
over time, it is my expectation that the scope of what is "internally
public" will expand, reducing the number of source files which need to
include *_impl.h and related headers down to those which are actually
implementing the corresponding subsystems, not just using them.
| Rich Felker | 2018-09-12 | 7 | -14/+0 |
| * | make mkostemps source file include the header for its declaration | Rich Felker | 2018-09-12 | 1 | -0/+1 |
| * | ignore access mode bits of flags in mkostemps and functions that use it•••per the text accepted for inclusion in POSIX, behavior is unspecified
when any of the access mode bits are set. since it's impossible to
consistently report this usage error (O_RDONLY could not be detected
since its value happens to be zero), the most consistent way to handle
them is just to ignore them.
previously, if a caller erroneously passed O_WRONLY, the resulting
access mode would be O_WRONLY|O_RDWR, which has the value 3, and this
resulted in a file descriptor which rejects both read and write
attempts when it is subsequently used.
| Rich Felker | 2014-10-06 | 1 | -0/+1 |
| * | include cleanups: remove unused headers and add feature test macros | Szabolcs Nagy | 2013-12-12 | 3 | -8/+2 |
| * | fix typo in comment in __randname | Rich Felker | 2013-09-04 | 1 | -1/+1 |
| * | fix (deprecated) mktemp logic and update it to match other temp functions•••the access function cannot be used to check for existence, because it
operates using real uid/gid rather than effective to determine
accessibility; this matters for the non-final path components.
instead, use stat. failure of stat is success if only the final
component is missing (ENOENT) and otherwise is failure.
| Rich Felker | 2013-08-02 | 1 | -4/+11 |
| * | remove (no longer useful) namespace-protected __mktemp symbol | Rich Felker | 2013-08-02 | 1 | -4/+1 |
| * | make mkdtemp and mkstemp family leave template unchanged on fail•••also refactor mkdtemp based on new shared temp code, removing
dependency on the deprecated mktemp, whose behavior made this logic
more difficult.
| Rich Felker | 2013-08-02 | 2 | -13/+18 |
| * | use memcmp instead of str[n]cmp for temp function XXXXXX checking | Rich Felker | 2013-02-20 | 2 | -2/+2 |
| * | fix error cases in mkostemps core•••1. wrong return value and missing errno for negative suffix len
2. failure to catch suffix len > strlen
3. remove unwanted clearing of input string in invalid case
| Rich Felker | 2013-02-20 | 1 | -6/+3 |
| * | remove leftover unused variable in mktemp after refactoring | Rich Felker | 2013-02-20 | 1 | -1/+0 |
| * | add mkostemp, mkstemps, and mkostemps functions and reorganize temp internals•••based on patch contributed by Anthony G. Basile (blueness)
some issues remain with the filename generation algorithm and other
small bugs, but this patch has been sitting around long enough that I
feel it's best to get it committed and then work out any remaining
issues.
| Rich Felker | 2013-02-20 | 6 | -29/+83 |
| * | remove ugly prng from mk*temp and just re-poll time on retry | Rich Felker | 2011-07-28 | 1 | -6/+5 |
| * | eliminate mk*temp dependency on snprintf•••this helps some tiny programs be even more tiny, and barly increases
code size even if both are used.
| Rich Felker | 2011-07-28 | 1 | -3/+4 |
| * | another return value fix for mktemp... | Rich Felker | 2011-06-12 | 1 | -1/+2 |
| * | make mktemp match the historic behavior, and update functions that use it•••the historic mktemp is supposed to blank the template string on
failure, rather than returning 0. just zero the first character so
that mkstemp and mkdtemp can still retry with O(1) space requirement.
| Rich Felker | 2011-02-19 | 3 | -5/+8 |
| * | fix major bug created from copying mkdtemp logic | Rich Felker | 2011-02-19 | 1 | -1/+1 |
| * | major improvements to temp file name generator•••use current time in nanoseconds and some potentially-random (if aslr
is enabled) pointer values for the initial tempfile name generation,
and step via a cheap linear prng on collisions. limit the number of
retry attempts to prevent denial of service attacks even if an
attacker can guess the filenames.
| Rich Felker | 2011-02-18 | 3 | -16/+21 |
| * | reformat mkstemp like mkdtemp•••this is cleaner and makes it easy to impose a limit on the number of
retries later if it seems desirable to do so.
| Rich Felker | 2011-02-18 | 1 | -7/+5 |
| * | ensure standard functions mk[sd]temp don't depend on removed function mktemp | Rich Felker | 2011-02-14 | 3 | -5/+9 |
| * | begin namespace-cleanup of standard C headers | Rich Felker | 2011-02-14 | 2 | -0/+2 |
| * | initial check-in, version 0.5.0 | Rich Felker | 2011-02-12 | 3 | -0/+76 |
