Skip to main content

resolve_safe_bin

Function resolve_safe_bin 

Source
pub fn resolve_safe_bin(name: &str) -> Option<PathBuf>
Expand description

Resolve name to an absolute path inside one of the trusted system binary directories. Returns None if not found in any trusted dir (do NOT fall back to Command::new(name) - that’s exactly the bug).

A candidate is accepted only when its lexical parent is a trusted dir AND its real target (following symlinks) is a regular file owned by root or the current effective uid, see [is_safe_target]. That ownership gate narrows the symlink-swap vector AT CHECK TIME without breaking legitimate cross-dir symlinks (e.g. Homebrew’s /opt/homebrew/bin/git -> ../Cellar/.../git, which is owned by the installing user). The returned path is the trusted-dir path (not the resolved target), so the allowlist contract is preserved.

RESIDUAL TOCTOU: the ownership check and the eventual Command exec are two separate resolutions of the same path. In a group/user-writable trusted dir an attacker who owns the dir can pass the check with a root-owned target and then swap the symlink before exec. Closing this fully requires the spawn site to exec the checked fd directly (fexecve / O_PATH|O_NOFOLLOW) or re-stat immediately before spawn; this function guarantees check-time safety only.