More checks when downloading from file:// scheme

[orazioedoardo]

Thank you for your contribution to the Pi-hole Community!

Please read the comments below to help us consider your Pull Request.

We are all volunteers and completing the process outlined will help us review your commits quicker.

Please make sure you

1. Base your code and PRs against the repositories developmental branch.
2. Sign Off all commits as we enforce the DCO for all contributions
3. Sign all your commits as they must have verified signatures
4. File a pull request for any change that requires changes to our documentation at our documentation repo

---

What does this PR aim to accomplish?:

Current checks when downloading from file:// scheme can be bypassed by creating a symlink to a file that is not world readable and downloading the symlink, which usually has 777 permissions. Checks also don’t stop non-regular files (though might fail when passed to curl later on). Impact is low IMHO since it requires unprivileged shell access to the system in addition of having access to the admin page.

By the way I’m not sure whether the admin page should still show snippets of invalid adlists when downloading from world readable file://. The set of users with admin access does not necessarily intersect with the users having shell access. Also consider that many distributions still set human home directories as 0755.

How does this PR accomplish the above?:

Test that the file is a regular file, follow symlinks when checking permissions with stat.

---

By submitting this pull request, I confirm the following:

1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
2. I have commented my proposed changes within the code and I have tested my changes.
3. I am willing to help maintain this change if there are issues with it later.
4. It is compatible with the EUPL 1.2 license
5. I have squashed any insignificant commits. (git rebase)
6. I have checked that another pull request for this purpose does not exist.
7. I have considered, and confirmed that this submission will be valuable to others.
8. I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
9. I give this submission freely, and claim no ownership to its content.

---

• I have read the above and my PR is ready for review. Check this box to confirm

[PromoFaux]

Are we sure this is a problem? I tried a test with sudo ln /etc/shadow blah and adding it as file:///home/pi/blah and get the following output:

  [i] Target: file:///home/pi/blah
  [✗] Cannot read file (file needs to have a+r permission)
<------  [✗] Status: Retrieval failed / empty list
  [✗] List download failed: no cached list available

[orazioedoardo]

Are we sure this is a problem?

Works for me.

sudo ln /etc/shadow blah

Are you sure blah is a symlink? ln without -s is a hard link.

Also you don’t need to create a link with sudo.

[PromoFaux]

OK, with -s then it works. So much for responsible disclosure, I guess! I think this is probably an edge-case as it would assume that someone has access to the shell to be able to create the symlink in the first place. However having tested your change with a symlink (created with sudo ln -s /etc/shadow blah) I can confirm that the symlink is followed and the original file's permissions are used - and that this doesn't break the already in-place functionality to prevent gravity from reading these files.

Also you don’t need to create a link with sudo.

pi@raspberrypi:/etc/pihole $ ln -s /etc/shadow test
ln: failed to create symbolic link 'test': Permission denied

[orazioedoardo]

ln: failed to create symbolic link 'test': Permission denied

Of course you can’t create a symlink inside /etc/pihole as pi user.

[PromoFaux]

Perhaps, but the point was you said one doesn't need sudo to create a symlink. If someone has root shell access, you probably have bigger problems!

OK, I see where I went wrong.

[orazioedoardo]

If someone has root shell access, you probably have bigger problems!

You just need shell access and a place to write the symlink, which can be the home folder of the user you have access to, doesn’t need to be root or having sudo access.