OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Apple MacOSX 10.9 Hard Link Memory Corruption

From: Stefan Arentz (stefanbasement.sateh.com)
Date: Fri Nov 08 2013 - 15:14:51 CST


On Thu, Nov 07, 2013 at 10:50:59PM +0000, submitcxsec.org wrote:

> mac-cxs-XK:pochd XK$ gcc -o test test.c
> mac-cxs-XK:pochd XK$ ls
> test test.c
> mac-cxs-XK:pochd XK$ mkdir DIR1
> mac-cxs-XK:pochd XK$ ./test DIR1 Hardlink1
> link(3) return= -1
> mac-cxs-XK:pochd XK$ mkdir DIR1/DIR2
> mac-cxs-XK:pochd XK$ ./test DIR1/DIR2 Hardlink2
> link(3) return= 0
> mac-cxs-XK:pochd XK$ cd DIR1
> mac-cxs-XK:DIR1 XK$ mkdir DIR2/DIR3
> mac-cxs-XK:DIR1 XK$ ../test DIR2/DIR3 Hardlink3
> link(3) return= 0
> mac-cxs-XK:DIR1 XK$ cd DIR2
> mac-cxs-XK:DIR2 XK$ mkdir DIR3/DIR4
> mac-cxs-XK:DIR2 XK$ ../../test DIR3/DIR4 Hardlink4
> link(3) return= -1

The first failing case is easily explained: directory hard links cannot have the same
parent. This is checked in hfs_link.c[1] in hfs_vnop_link(). Search for the following
comment:

        /*
         * All directory links must reside in an non-ARCHIVED hierarchy.
         */
        if (v_type == VDIR) {
                /*
                 * - Source parent and destination parent cannot match
                 * - A link is not permitted in the root directory
                 * - Parent of 'pointed at' directory is not the root directory
                 * - The 'pointed at' directory (source) is not an ancestor
                 * of the new directory hard link (destination).
                 * - No ancestor of the new directory hard link (destination)
                 * is a directory hard link.
                 */
                if ((parentcnid == tdcp->c_fileid) ||
                    (tdcp->c_fileid == kHFSRootFolderID) ||
                    (parentcnid == kHFSRootFolderID) ||
                    cat_check_link_ancestry(hfsmp, tdcp->c_fileid, cp->c_fileid)) {
                        error = EPERM; /* abide by the rules, you did not */
                        goto out;
                }
        }

Does this also explain the last case?

 S.

[1] http://opensource.apple.com/source/xnu/xnu-2422.1.72/bsd/hfs/hfs_link.c