--- old/policyd-weight   Tue Mar 25 00:25:39 2008
+++ new/policyd-weight   Fri Mar 28 15:01:29 2008
@@ -23,9 +23,9 @@
 # see http://spf.pobox.com/
 #
 # AUTHOR:  r.felber@ek-muc.de
-# DATE:    Mon Mar 24 23:59:00 CET 2008
+# DATE:    Fri Mar 28 14:08:20 CET 2008
 # NAME:    policyd-weight
-# VERSION: 0.1.14 beta-15
+# VERSION: 0.1.14 beta-17
 # URL:     http://www.policyd-weight.org/


@@ -65,6 +65,7 @@
 # begin
 use strict;
 use Fcntl;
+use File::Spec;
 use Sys::Syslog qw(:DEFAULT setlogsock);
 use Net::DNS;
 use Net::DNS::Packet qw(dn_expand);
@@ -78,7 +79,7 @@

 use vars qw($csock $s $tcp_socket $sock $new_sock $old_mtime);

-our $VERSION   = "0.1.14 beta-15";
+our $VERSION   = "0.1.14 beta-17";
 our $CVERSION  = 5;                 # cache interface version
 our $CMD_DEBUG = 0;                 # -d switch
 our $KILL;                          # -k switch
@@ -3614,6 +3615,9 @@
 }


+
+
+
 #
 # usage: check_symlnk($caller, @files)
 #
@@ -3624,12 +3628,55 @@
     my $who = shift;
     for ( @_ )
     {
-        if( -l $_ )
+
+        my $file = File::Spec->canonpath($_);
+
+        my @stat = lstat( $file );
+
+        if(! -e _)
+        {
+            next;
+        }
+
+
+        # first, file must not be a symlink
+        if ( -l _ )
+        {
+            fatal_exit("$who: $file is a symbolic link. Symbolic links are not expected and not allowed within policyd-weight. Exiting!");
+        }
+
+
+        # second, file must be owned by uid root or $USER and
+        # gid root/wheel or $USER
+        if(!(
+                (
+                    $stat[4] == getpwnam($USER) ||
+                    $stat[4] == "0"
+                ) &&
+                (
+                    $stat[5] == getgrnam($GROUP) ||
+                    $stat[5] == "0"
+                )
+            )
+          )
         {
-            fatal_exit("$who: $_ is a symbolic link. Symbolic links are not expected and not allowed within policyd-weight. Exiting!");
+            fatal_exit("$who: $file is owned by UID $stat[4], GID $stat[5]. Exiting!");
         }
+
+
+        # second the file/dir must not be world writeable
+        if(sprintf("%04o",$stat[2]) =~ /(7|6|3|2)$/)
+        {
+            fatal_exit("$who: $file is world writeable. Exiting!");
+        }
+
+
     }
 }
+
+
+
+


 # function for sanitizing floating point output