--- old/policyd-weight      Fri Mar 28 10:06:46 2008
+++ new/policyd-weight      Fri Mar 28 14:08:30 2008
@@ -23,9 +23,9 @@
 # see http://spf.pobox.com/
 #
 # AUTHOR:  r.felber@ek-muc.de
-# DATE:    Fri Mar 28 10:08:42 CET 2008
+# DATE:    Fri Mar 28 14:08:20 CET 2008
 # NAME:    policyd-weight
-# VERSION: 0.1.14 beta-16
+# VERSION: 0.1.14 beta-17
 # URL:     http://www.policyd-weight.org/


@@ -65,6 +65,7 @@
 # begin
 use strict;
 use Fcntl;
+use File::Spec;
 use Sys::Syslog qw(:DEFAULT setlogsock);
 use Net::DNS;
 use Net::DNS::Packet qw(dn_expand);
@@ -78,7 +79,7 @@

 use vars qw($csock $s $tcp_socket $sock $new_sock $old_mtime);

-our $VERSION   = "0.1.14 beta-16";
+our $VERSION   = "0.1.14 beta-17";
 our $CVERSION  = 5;                 # cache interface version
 our $CMD_DEBUG = 0;                 # -d switch
 our $KILL;                          # -k switch
@@ -3614,6 +3615,9 @@
 }


+
+
+
 #
 # usage: check_symlnk($caller, @files)
 #
@@ -3625,17 +3629,53 @@
     for ( @_ )
     {

-        # strip trailing '/'
-        # perl and test(1) ignore the request for -l/-L and
-        # do a lstat with S_IFDIR (added in 0.1.14 beta-16)
-        s/\/+$//;
+        my $file = File::Spec->canonpath($_);
+
+        my @stat = lstat( $file );

-        if ( -l $_ )
+        if(! -e _)
         {
-            fatal_exit("$who: $_ is a symbolic link. Symbolic links are not expected and not allowed within policyd-weight. Exiting!");
+            next;
         }
+
+
+        # first, file must not be a symlink
+        if ( -l _ )
+        {
+            fatal_exit("$who: $file is a symbolic link. Symbolic links are not expected and not allowed within policyd-weight. Exiting!");
+        }
+
+
+        # second, file must be owned by uid root or $USER and
+        # gid root/wheel or $USER
+        if(!
+            (
+                $stat[4] == getpwnam($USER) ||
+                $stat[4] == "0"
+            ) &&
+            (
+                $stat[5] == getgrnam($GROUP) ||
+                $stat[5] == "0"
+            )
+          )
+        {
+            fatal_exit("$who: $file is owned by UID $stat[4], GID $stat[5]. Exiting!");
+        }
+
+
+        # second the file/dir must not be world writeable
+        if(sprintf("%04o",$stat[2]) =~ /(7|6|3|2)$/)
+        {
+            fatal_exit("$who: $file is world writeable. Exiting!");
+        }
+
+
     }
 }
+
+
+
+


 # function for sanitizing floating point output