src/perm_permissions_table.c

@@ -212,20 +212,14 @@ access_t check_perm_access_noparent(const char *filename,
 
   access_t ret = NDEF;
   sqlite3_stmt *stmt = NULL;
-  const char *sql =
+  const char *sql = "SELECT mode FROM permissions WHERE executable = ?1 "
-      "SELECT mode FROM permissions WHERE executable = ?1 "
+                    "AND (( ?2 LIKE CONCAT(filename, \'%\') AND filename "
-      "AND (( ?2 LIKE CONCAT(filename, \'%\') AND filename "
+                    "GLOB \'*/\') OR filename = ?2 );";
-      "GLOB \'*/\') OR filename = ?2 ) ORDER BY LENGTH( filename ) DESC;";
   sqlite3_prepare_v2(perm_database, sql, -1, &stmt, NULL);
   sqlite3_bind_text(stmt, 1, pi.name, -1, SQLITE_STATIC);
   sqlite3_bind_text(stmt, 2, filename, -1, SQLITE_STATIC);
 
   int step_ret = sqlite3_step(stmt);
-  if (step_ret != SQLITE_ROW && step_ret != SQLITE_DONE) {
-    fprintf(stderr, "SQLite error: %s\n", sqlite3_errstr(step_ret));
-    sqlite3_finalize(stmt);
-    return ret;
-  }
   if (step_ret == SQLITE_ROW) {
     int mode_col = sqlite3_column_int(stmt, 0);
     if (mode_col) {
@@ -233,6 +227,8 @@ access_t check_perm_access_noparent(const char *filename,
     } else {
       ret = DENY;
     }
+  } else {
+    fprintf(stderr, "SQLite error: %s\n", sqlite3_errstr(step_ret));
   }
   sqlite3_finalize(stmt);
 

src/temp_permissions_table.c

@@ -192,32 +192,26 @@ access_t check_temp_access_noparent(const char *filename, pid_t pid) {
       // the process is the same as the one that was granted temporary access
       // to the file
       size_t filename_len = strlen(filename);
-      access_t ret = NDEF;
-      size_t maxlen = 0;
       for_each(&permission_entry->denied_files, denied_file) {
         size_t denied_file_len = strlen(*denied_file);
-        if ((strncmp(*denied_file, filename, denied_file_len) == 0 &&
+        if (strncmp(*denied_file, filename, denied_file_len) == 0 &&
-             ((denied_file_len < filename_len &&
+            ((denied_file_len < filename_len &&
-               (*denied_file)[denied_file_len - 1] == '/') ||
+              (*denied_file)[denied_file_len - 1] == '/') ||
-              (denied_file_len == filename_len))) &&
+             (denied_file_len == filename_len))) {
-            denied_file_len > maxlen) {
+          pthread_rwlock_unlock(&temp_permissions_table_lock);
-          maxlen = denied_file_len;
+          return DENY;
-          ret = DENY;
         }
       }
       for_each(&permission_entry->allowed_files, allowed_file) {
         size_t allowed_file_len = strlen(*allowed_file);
-        if ((strncmp(*allowed_file, filename, allowed_file_len) == 0 &&
+        if (strncmp(*allowed_file, filename, allowed_file_len) == 0 &&
-             ((allowed_file_len < filename_len &&
+            ((allowed_file_len < filename_len &&
-               (*allowed_file)[allowed_file_len - 1] == '/') ||
+              (*allowed_file)[allowed_file_len - 1] == '/') ||
-              (allowed_file_len == filename_len))) &&
+             (allowed_file_len == filename_len))) {
-            allowed_file > maxlen) {
+          pthread_rwlock_unlock(&temp_permissions_table_lock);
-          maxlen = allowed_file_len;
+          return ALLOW;
-          ret = ALLOW;
         }
       }
-      pthread_rwlock_unlock(&temp_permissions_table_lock);
-      return ret;
     }
   }
   pthread_rwlock_unlock(&temp_permissions_table_lock);