[net.unix-wizards] so who has mkdir and rmdir for system V

ado@elsie.UUCP (07/13/86)

In article <1885@brl-smoke.ARPA>, gwyn@BRL.ARPA (VLD/VMB) writes:
> int
> mkdir( dirname )
> 	char	*dirname;
> 	{
> ...
> 	(void) strcat( strcpy( buf, "mkdir 2>/dev/null " ), dirname );
> 	retval = system( buf );	/* assuming your system() works right */
> ...

The above can use a bit of idiot proofing--especially against meta characters
in dirname.  Below is the version of "mkdir" that went out with the time zone
stuff.

	#

	/*LINTLIBRARY*/

	#include "stdio.h"

	#ifdef OJBECTID
	static char	sccsid[] = "@(#)mkdir.c	7.2";
	#endif

	extern FILE *	popen();

	mkdir(name)
	char *	name;
	{
		register FILE *	fp;
		register int	c;
		register int	oops;

		if ((fp = popen("sh", "w")) == NULL)
			return -1;
		(void) fputs("mkdir 2>&- '", fp);
		if (name != NULL)
			while ((c = *name++) != '\0')
				if (c == '\'')
					(void) fputs("'\\''", fp);
				else	(void) fputc(c, fp);
		(void) fputs("'\n", fp);
		oops = ferror(fp);
		return (pclose(fp) == 0 && !oops) ? 0 : -1;
	}
--
UNIX and System V are an AT&T Bell Laboratories (or AT&T registered) trademarks.
--
	UUCP: ..decvax!seismo!elsie!ado   ARPA: elsie!ado@seismo.ARPA
	DEC, VAX, Elsie & Ado are Digital, Borden & Ampex trademarks.

jas@rtech.UUCP (07/14/86)

Keywords:


Regarding "idiot proofing" a mkdir library routine:  code like this

		if ((fp = popen("sh", "w")) == NULL)
			return -1;
		(void) fputs("mkdir 2>&- '", fp);

is a security problem for setuid-root (or setuid-anybody) programs
that want to call it.  "/bin/sh" and "/bin/mkdir" should be specified,
for reasons that should be clear.

Jim Shankland
 ..!ihnp4!cpsc6a!\
		  rtech!jas
..!ucbvax!mtxinu!/