[Asterisk-code-review] res_crypto: Don't load non-regular files in keys directory (asterisk[master])

[Philip Prindeville]

Attention is currently required from: George Joseph.
Philip Prindeville has posted comments on this change. ( https://gerrit.asterisk.org/c/asterisk/+/18533 )

Change subject: res_crypto: Don't load non-regular files in keys directory
......................................................................


Patch Set 7:

(3 comments)

Patchset:

PS7: 
> Is this a requirement for using the EVP_KPEY apis?
It is not. It was a target-of-opportunity, and possibly something that might generate SElinux warnings, so I fixed it.

It is a standalone commit because it is unrelated to everything else.


PS7: 
Symlinking keys is not good security hygiene.


File res/res_crypto.c:

https://gerrit.asterisk.org/c/asterisk/+/18533/comment/5be0fd56_6b76dbcb 
PS7, Line 518: DT_REG
> Meant to ask yesterday but forgot...  What about symlinks?  I think we need to allow DT_LNK as well.
As it stands now, using symlinks would be problematic because you'd need to check the ownership and permissions of the directory containing the key file, and then check the same on the file itself.

ssh, for instance, won't allow private keys to reside outside of the ~/.ssh/ directory when scanning that directory.

I've seen buttoned down versions of it that won't even allow it to be read if the link count on the file is anything but 1.



-- 
To view, visit https://gerrit.asterisk.org/c/asterisk/+/18533
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Change-Id: Ie77e0648f8b0b1c2159fb24662d1989cfd4cc36d
Gerrit-Change-Number: 18533
Gerrit-PatchSet: 7
Gerrit-Owner: Philip Prindeville <philipp at redfish-solutions.com>
Gerrit-Reviewer: Friendly Automation
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Attention: George Joseph <gjoseph at digium.com>
Gerrit-Comment-Date: Tue, 10 May 2022 15:15:39 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: George Joseph <gjoseph at digium.com>
Gerrit-MessageType: comment
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20220510/2e5bf2a6/attachment.html>