configure.ac: bump version

Small improvements after static code analysis.

Signed-off-by: Alex Jaramillo <alex.v.jaramillo@intel.com>

README.md

@@ -333,7 +333,12 @@ $ org.clearlinux/hello/world     Mon 2018-04-02 17:48:01 UTC a19a0d41ba16788881e
 $ hello
 ```
 
+## Using tarball
+
+When building the telemetrics-client using the tarball, a signature is provided for
+validation. Please follow the steps outlined in the release's README.txt for guidance.
+
 ## Security Disclosures
 
 To report a security issue or receive security advisories please follow procedures
-in this [link](https://01.org/security).
+in [link](security.md).

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.69])
-AC_INIT([telemetrics-client], [2.4.2], [https://clearlinux.org/])
+AC_INIT([telemetrics-client], [2.4.3], [https://clearlinux.org/])
 AC_CONFIG_AUX_DIR([build-aux])
 AM_INIT_AUTOMAKE([1.14 -Wall -Werror -Wno-extra-portability foreign subdir-objects])
 AM_SILENT_RULES([yes])

security.md

@@ -0,0 +1,9 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our 
+customers and providing clear guidance on the solution, impact, severity and 
+mitigation.
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project [utilizing the 
+guidelines here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).
+

src/probes/crash_probe.c

@@ -587,7 +587,7 @@ int main(int argc, char **argv)
         }
 
         if (core_file) {
-                core_fd = open(core_file, O_RDONLY);
+                core_fd = open(core_file, O_RDONLY|O_NOFOLLOW);
                 if (core_fd == -1) {
                         telem_perror("Failed to open input core file");
                         goto fail;

src/probes/pstore_clean.c

@@ -44,14 +44,14 @@ int copy_file(char *src_file, char *dest_file)
         ssize_t bytes_read, bytes_written;
         int ret = -1;
 
-        src_fd = open(src_file, O_RDONLY);
+        src_fd = open(src_file, O_RDONLY|O_NOFOLLOW);
         if (src_fd == -1) {
                 telem_log(LOG_ERR, "Failed to open file %s:%s\n", src_file,
                           strerror(errno));
                 goto end;
         }
 
-        dest_fd = open(dest_file, O_WRONLY | O_CREAT, 0644);
+        dest_fd = open(dest_file, O_WRONLY|O_CREAT|O_NOFOLLOW, 0644);
         if (dest_fd == -1) {
                 telem_log(LOG_ERR, "Failed to create file %s:%s\n", dest_file,
                           strerror(errno));

src/spool.c

@@ -151,15 +151,14 @@ void process_spooled_record(const char *spool_dir, char *name,
 
         (*records_processed)++;
         // Use file descriptor to mitigate TOCTOU
-        int fd = open(record_name, O_RDONLY | O_NOFOLLOW);
+        int fd = open(record_name, O_RDONLY|O_NOFOLLOW);
         if (fd == -1) {
                 telem_perror("Unable to open record in spool");
-                goto exit;
+                goto clean;
         }
 
         if (fstat(fd, &buf) == -1) {
                 telem_perror("Unable to fstat record in spool");
-                close(fd);
                 goto exit;
         }
 
@@ -178,9 +177,7 @@ void process_spooled_record(const char *spool_dir, char *name,
             (current_time - buf.st_mtime > (record_expiry_config() * 60)) ||
             (buf.st_uid != getuid())) {
                 unlink(record_name);
-                close(fd);
         } else if (post_succeeded && *records_sent <= TM_SPOOL_MAX_SEND_RECORDS) {
-                close(fd);
                 transmit_spooled_record(record_name, &post_succeeded, buf.st_size);
 
                 if (!post_succeeded) {
@@ -206,6 +203,8 @@ void process_spooled_record(const char *spool_dir, char *name,
                 }
         }
 exit:
+        close(fd);
+clean:
         free(record_name);
 }
 
@@ -356,6 +355,7 @@ int spool_record_compare(const void *entrya, const void *entryb, void *path)
         ret = stat(pathb, &statentryb);
         if (ret == -1) {
                 telem_log(LOG_ERR, "Unable to stat %s: %s\n", patha, strerror(errno));
+                free(patha);
                 free(pathb);
                 return 0;
         }

src/telemctl.c

@@ -428,7 +428,7 @@ static int telemctl_opt_in(void)
 
         /* Create a brand new file TM_OPT_IN, we may fail because the file exists already.
          * In that case we are already opted in and we are done here. */
-        int fd = open(TM_OPT_IN, O_CREAT|O_EXCL|O_WRONLY, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
+        int fd = open(TM_OPT_IN, O_CREAT|O_EXCL|O_WRONLY, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH|O_NOFOLLOW);
         if (fd == -1) {
                 if (errno == EEXIST) {
                         fprintf(stderr, "Already opted in. Nothing to do.\n");

src/telemetry.c

@@ -49,9 +49,9 @@ static int version_file(void)
 {
         int fd;
 
-        fd = open(TM_SITE_VERSION_FILE, O_RDONLY);
+        fd = open(TM_SITE_VERSION_FILE, O_RDONLY|O_NOFOLLOW);
         if (fd < 0) {
-                fd = open(TM_DIST_VERSION_FILE, O_RDONLY);
+                fd = open(TM_DIST_VERSION_FILE, O_RDONLY|O_NOFOLLOW);
         }
 
         return fd;

src/util.c

@@ -143,7 +143,7 @@ int get_random_id(char **buff)
         int frandom = -1;
         uint64_t random_id[2] = { '\0' };
 
-        frandom = open("/dev/urandom", O_RDONLY);
+        frandom = open("/dev/urandom", O_RDONLY|O_NOFOLLOW);
         if (frandom < 0) {
                 return -1;
         }