crash-reporter: Avoid writing through symlinks.

kernel_collector.cc

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crash-reporter/kernel_collector.h"
 
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "crash-reporter/system_logging.h"
@@ skipping 259 matching lines @@
       return true;
     }
 
     std::string dump_basename =
         FormatDumpBasename(kKernelExecName,
                            time(NULL),
                            kKernelPid);
     FilePath kernel_crash_path = root_crash_directory.Append(
         StringPrintf("%s.kcrash", dump_basename.c_str()));
 
-    if (file_util::WriteFile(kernel_crash_path,
-                             kernel_dump.data(),
-                             kernel_dump.length()) !=
+    // We must use WriteNewFile instead of file_util::WriteFile as we
+    // do not want to write with root access to a symlink that an attacker
+    // might have created.
+    if (WriteNewFile(kernel_crash_path,
+                     kernel_dump.data(),
+                     kernel_dump.length()) !=
         static_cast<int>(kernel_dump.length())) {
       logger_->LogInfo("Failed to write kernel dump to %s",
                        kernel_crash_path.value().c_str());
       return true;
     }
 
     AddCrashMetaData(kKernelSignatureKey, signature);
     WriteCrashMetaData(
         root_crash_directory.Append(
             StringPrintf("%s.meta", dump_basename.c_str())),
         kKernelExecName,
         kernel_crash_path.value());
 
     logger_->LogInfo("Stored kcrash to %s",
                      kernel_crash_path.value().c_str());
   }
   if (!ClearPreservedDump()) {
     return false;
   }
 
   return true;
 }