Gamin the File Alteration Monitor

While gamin still use a server to provide the service (ideally if the kernel had a proper interface a library only implementation should be doable and possibly better), it tries to avoid security hazard associated to contacting an external server process:

• the server runs under the same privilege level as the client, by running under the uid, no root or superuser access is involved, this is checked by both side using kernel support for the checking
• when possible (e.g. on Linux) the socket used to communicate is not mapped at the filesystem level to avoid risks related to opening a real file, if the kernel doesn't allow this a per user directory holding the socket is used and appropriate rights are checked.
• to limit DoS attacks done by continuously modifying a monitored resource, the daemon will switch back monitoring of very busy resources to polling with generation of events only once per second.

Here is the process used to acquire and create the sockets:

If there is abstract socket support:

Use the filename "\0/tmp/fam-$USER-$GAM_CLIENT_ID". They are not mapped on the filesystem, no attack is possible that way. The client and the server checks on the first '\0' byte received from the socket that the other side is running under the same UID.

If there is no abstract socket support:

On the server side:

 start:
  try to create /tmp/fam-$USER using mkdir('/tmp/fam-$USER', 007)
  if error:
      make a stat() on it
      if doesn't exist:
          return failure to create
      if user is not getuid() or mode is not 007 or type is not dir:
          try to unlink()
          if error:
              exit with error.
          if success:
              goto start:
                                                                                
  do the socket()/bind() on /tmp/fam-$USER/fam-$GAM_CLIENT_ID

On the client side:

  make a stat on /tmp/fam-$USER
  if doesn't exist:
      return failure to create should start the server
  if user is not getuid() or mode is not 007 or type is not dir:
      try to unlink()
      if error:
          exit with error.
      if success:
          return failure should start the server
  make a stat on /tmp/fam-$USER/fam-$GAM_CLIENT_ID
  if doesn't exist:
      return failure to create should start the server
  if user is not getuid() or type is not socket:
      try to unlink()
      if error:
          exit with error.
      if success:
          return failure should start the server
                                                                                
  do the socket()/connect() on /tmp/fam-$USER/fam-$GAM_CLIENT_ID

The client and the server checks on the first '\0' byte received that the other side is of the same UID.

Daniel Veillard