Skip to content

Commit

Permalink
Remove access() call from Snapsafe detection (#2197)
Browse files Browse the repository at this point in the history
### Description of changes: 
This change uses stat() instead of access() to check for the existence
of the Sysgenid device. This is more accurate to ascertain whether the
device exists on a machine. access() could fail for various other
reasons such as missing permissions.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
  • Loading branch information
smittals2 authored Feb 20, 2025
1 parent 82a16b6 commit adc59f0
Showing 1 changed file with 6 additions and 15 deletions.
21 changes: 6 additions & 15 deletions crypto/fipsmodule/rand/snapsafe_detect.c
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
#include <fcntl.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <unistd.h>
#include "../delocate.h"

Expand All @@ -21,28 +22,18 @@ DEFINE_STATIC_ONCE(aws_snapsafe_init)
DEFINE_BSS_GET(volatile uint32_t *, sgc_addr)
DEFINE_BSS_GET(int, snapsafety_state)

// aws_snapsafe_check_kernel_support returns 1 if the special sysgenid device
// file exists and 0 otherwise.
static int aws_snapsafe_check_kernel_support(void) {
// This file-exist method is generally brittle. But for our purpose, this
// should be more than fine.
if (access(CRYPTO_get_sysgenid_path(), F_OK) != 0) {
return 0;
}
return 1;
}

static void do_aws_snapsafe_init(void) {
*snapsafety_state_bss_get() = SNAPSAFETY_STATE_NOT_SUPPORTED;
*sgc_addr_bss_get() = NULL;
*snapsafety_state_bss_get() = SNAPSAFETY_STATE_NOT_SUPPORTED;

if (aws_snapsafe_check_kernel_support() != 1) {
struct stat buff;
if (stat(CRYPTO_get_sysgenid_path(), &buff) != 0) {
return;
}
*snapsafety_state_bss_get() = SNAPSAFETY_STATE_FAILED_INITIALISE;

*snapsafety_state_bss_get() = SNAPSAFETY_STATE_FAILED_INITIALISE;
int fd_sgc = open(CRYPTO_get_sysgenid_path(), O_RDONLY);
if (fd_sgc == -1) {
if (fd_sgc < 0) {
return;
}

Expand Down

0 comments on commit adc59f0

Please sign in to comment.