archive repository

Small improvements after static code analysis.

Signed-off-by: Alex Jaramillo <alex.v.jaramillo@intel.com>

README.md

@@ -1,3 +1,10 @@
+## DISCONTINUATION OF PROJECT. 
+
+This project will no longer be maintained by Intel. 
+
+Intel will not provide or guarantee development of or support for this project, including but not limited to, maintenance, bug fixes, new releases or updates. Patches to this project are no longer accepted by Intel. If you have an ongoing need to use this project, are interested in independently developing it, or would like to maintain patches for the community, please create your own fork of the project.
+
+Contact: webadmin@linux.intel.com  
 ![](https://github.com/clearlinux/telemetrics-client/workflows/C%2FC++%20CI/badge.svg)
 
 Telemetrics-client
@@ -333,7 +340,12 @@ $ org.clearlinux/hello/world     Mon 2018-04-02 17:48:01 UTC a19a0d41ba16788881e
 $ hello
 ```
 
+## Using tarball
+
+When building the telemetrics-client using the tarball, a signature is provided for
+validation. Please follow the steps outlined in the release's README.txt for guidance.
+
 ## Security Disclosures
 
 To report a security issue or receive security advisories please follow procedures
-in this [link](https://01.org/security).
+in [link](security.md).

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.69])
-AC_INIT([telemetrics-client], [2.4.0], [https://clearlinux.org/])
+AC_INIT([telemetrics-client], [2.4.3], [https://clearlinux.org/])
 AC_CONFIG_AUX_DIR([build-aux])
 AM_INIT_AUTOMAKE([1.14 -Wall -Werror -Wno-extra-portability foreign subdir-objects])
 AM_SILENT_RULES([yes])

security.md

@@ -0,0 +1,9 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our 
+customers and providing clear guidance on the solution, impact, severity and 
+mitigation.
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project [utilizing the 
+guidelines here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).
+

src/probes/crash_probe.c

@@ -587,7 +587,7 @@ int main(int argc, char **argv)
         }
 
         if (core_file) {
-                core_fd = open(core_file, O_RDONLY);
+                core_fd = open(core_file, O_RDONLY|O_NOFOLLOW);
                 if (core_fd == -1) {
                         telem_perror("Failed to open input core file");
                         goto fail;

src/probes/pstore_clean.c

@@ -44,14 +44,14 @@ int copy_file(char *src_file, char *dest_file)
         ssize_t bytes_read, bytes_written;
         int ret = -1;
 
-        src_fd = open(src_file, O_RDONLY);
+        src_fd = open(src_file, O_RDONLY|O_NOFOLLOW);
         if (src_fd == -1) {
                 telem_log(LOG_ERR, "Failed to open file %s:%s\n", src_file,
                           strerror(errno));
                 goto end;
         }
 
-        dest_fd = open(dest_file, O_WRONLY | O_CREAT, 0644);
+        dest_fd = open(dest_file, O_WRONLY|O_CREAT|O_NOFOLLOW, 0644);
         if (dest_fd == -1) {
                 telem_log(LOG_ERR, "Failed to create file %s:%s\n", dest_file,
                           strerror(errno));

src/spool.c

@@ -151,15 +151,14 @@ void process_spooled_record(const char *spool_dir, char *name,
 
         (*records_processed)++;
         // Use file descriptor to mitigate TOCTOU
-        int fd = open(record_name, O_RDONLY | O_NOFOLLOW);
+        int fd = open(record_name, O_RDONLY|O_NOFOLLOW);
         if (fd == -1) {
                 telem_perror("Unable to open record in spool");
-                goto exit;
+                goto clean;
         }
 
         if (fstat(fd, &buf) == -1) {
                 telem_perror("Unable to fstat record in spool");
-                close(fd);
                 goto exit;
         }
 
@@ -178,9 +177,7 @@ void process_spooled_record(const char *spool_dir, char *name,
             (current_time - buf.st_mtime > (record_expiry_config() * 60)) ||
             (buf.st_uid != getuid())) {
                 unlink(record_name);
-                close(fd);
         } else if (post_succeeded && *records_sent <= TM_SPOOL_MAX_SEND_RECORDS) {
-                close(fd);
                 transmit_spooled_record(record_name, &post_succeeded, buf.st_size);
 
                 if (!post_succeeded) {
@@ -206,6 +203,8 @@ void process_spooled_record(const char *spool_dir, char *name,
                 }
         }
 exit:
+        close(fd);
+clean:
         free(record_name);
 }
 
@@ -356,6 +355,7 @@ int spool_record_compare(const void *entrya, const void *entryb, void *path)
         ret = stat(pathb, &statentryb);
         if (ret == -1) {
                 telem_log(LOG_ERR, "Unable to stat %s: %s\n", patha, strerror(errno));
+                free(patha);
                 free(pathb);
                 return 0;
         }

src/telemctl.c

@@ -428,7 +428,7 @@ static int telemctl_opt_in(void)
 
         /* Create a brand new file TM_OPT_IN, we may fail because the file exists already.
          * In that case we are already opted in and we are done here. */
-        int fd = open(TM_OPT_IN, O_CREAT|O_EXCL|O_WRONLY, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
+        int fd = open(TM_OPT_IN, O_CREAT|O_EXCL|O_WRONLY, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH|O_NOFOLLOW);
         if (fd == -1) {
                 if (errno == EEXIST) {
                         fprintf(stderr, "Already opted in. Nothing to do.\n");

src/telemetry.c

@@ -49,9 +49,9 @@ static int version_file(void)
 {
         int fd;
 
-        fd = open(TM_SITE_VERSION_FILE, O_RDONLY);
+        fd = open(TM_SITE_VERSION_FILE, O_RDONLY|O_NOFOLLOW);
         if (fd < 0) {
-                fd = open(TM_DIST_VERSION_FILE, O_RDONLY);
+                fd = open(TM_DIST_VERSION_FILE, O_RDONLY|O_NOFOLLOW);
         }
 
         return fd;

src/util.c

@@ -143,7 +143,7 @@ int get_random_id(char **buff)
         int frandom = -1;
         uint64_t random_id[2] = { '\0' };
 
-        frandom = open("/dev/urandom", O_RDONLY);
+        frandom = open("/dev/urandom", O_RDONLY|O_NOFOLLOW);
         if (frandom < 0) {
                 return -1;
         }