From: Stephen Smalley <stephen.smalley.work@xxxxxxxxx> Prior to rename(2)'ing new files into place, fsync(2) them to ensure the contents will be fully written prior to rename. While we are here, also fix checking of write(2) to detect short writes. This code could be more generally improved but keeping to the minimal changes required to fix this bug. Fixes: https://github.com/SELinuxProject/selinux/issues/237 Signed-off-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx> --- libsemanage/src/semanage_store.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libsemanage/src/semanage_store.c b/libsemanage/src/semanage_store.c index 859c0a22..3cac36d4 100644 --- a/libsemanage/src/semanage_store.c +++ b/libsemanage/src/semanage_store.c @@ -735,7 +735,7 @@ int semanage_copy_file(const char *src, const char *dst, mode_t mode) } umask(mask); while (retval == 0 && (amount_read = read(in, buf, sizeof(buf))) > 0) { - if (write(out, buf, amount_read) < 0) { + if (write(out, buf, amount_read) != amount_read) { errsv = errno; retval = -1; } @@ -745,6 +745,10 @@ int semanage_copy_file(const char *src, const char *dst, mode_t mode) retval = -1; } close(in); + if (fsync(out) < 0) { + errsv = errno; + retval = -1; + } if (close(out) < 0) { errsv = errno; retval = -1; -- 2.23.3
