0

In my C++ program I download images (album art etc.) from over the air radio signals and need to save the images in a public web folder such as /var/www/html to serve later via a web page.

I'm developing on Ubuntu 16.04 but eventually, the app will be deployed on Raspberry Pi. My program is a WebSocket Server using the library uWebsockets and also talks to a radio tuner via unix sockets. The app is supposed to auto-start at boot time and act as WebSocket server on a specific port.

Here's the code to save the image array -

    std::string filePath = "/var/www/html/output1.jpg";
    std::ofstream ofs(filePath);
    ofs.write(image->c_str(), image->size()); // image is JPEG image as string array
    ofs.flush();
    ofs.close();

Above code won't create file at the specified location, however it will work if the path is just "output1.jpg".

Clearly, my app doesn't have permission to write to /var/www/html. Is there any way to solve this using standard c++ or boost?

Thanks

kaushal
  • 785
  • 12
  • 27
  • 5
    You have to run the app from an account that has the correct permissions. – Galik Oct 24 '17 at 15:44
  • 4
    You can only write to directories to which the running process has access permissions. Unless you make the user of your programm give credentials for a user who *has* such permissions, there is nothing any programming library can, or indeed, **should be able to** do. That would be a security vulnerability. – DevSolar Oct 24 '17 at 15:46
  • Ok, above code won't create file. Any errors? – Sv Sv Oct 24 '17 at 15:50
  • No errors, but no file will be create either. Program runs ok. – kaushal Oct 24 '17 at 15:51
  • 3
    @kaushal You probably do have errors but you do not check for them. – Galik Oct 24 '17 at 15:51
  • 1
    Try `if(!ofs) std::cerr << std::strerror(errno) << '\n';` after opening the file. – Galik Oct 24 '17 at 15:52
  • Did you try to use filePath like \\\var\\www\\html\\output1.jpg? – Sv Sv Oct 24 '17 at 15:52
  • 1
    @Galik, I meant the program didn't crash or anything like that. Yes, I didn't check the code, but I knew it doesn't create the file because of permissions – kaushal Oct 24 '17 at 15:53
  • @SvSv this is on Ubuntu/Linux – kaushal Oct 24 '17 at 15:54
  • 2
    If there was a way to circumvent the permissions programatically then Lunux would be full of viruses. Linux developers put a lot of effort into making it impossible to do what you are asking. Virus writers look for flaws in their programming to exploit in an effort to do what you want to do. – Galik Oct 24 '17 at 15:55
  • Can you create a file in that directory manually? Like "touch /var/www/html/output1.jpg" – Sv Sv Oct 24 '17 at 15:56
  • 1
    @Galik I understand. No, I don't want to circumvent anything here :). I just want to be able to save the files there and if it's possible pragmatically. My application requires me to save files to serve via web page later. But It seems like it is not possible by design then. – kaushal Oct 24 '17 at 15:57
  • You can save files in a temp folder, and then just copy them, using OS API. – Sv Sv Oct 24 '17 at 15:58
  • @kaushal If you don’t have permission to do it, but want to do it anyway, then you *do* want to circumvent the thing that doesn’t let you. If you own the computer you can (once, not programmatically) go in and change directory permissions with `chmod`, or you can run this program as the appropriate user. – Daniel H Oct 24 '17 at 15:59
  • 1
    There are two ways you could move forward. Either run your program as the user that runs the web-server or configure the web-server to access a folder in your home directory with your permissions. – Galik Oct 24 '17 at 15:59
  • You may want to invest your time looking at the code for many existing web-based applications that read and write files, and how they work within the confines of the underlying operating system security model. – Sam Varshavchik Oct 24 '17 at 15:59
  • @DevSolar This is an example of a question asking for a security vulneratility to solve a practical problem. In order to answer it we need more information about the host OS and system. It is also an X/Y problem. – Yakk - Adam Nevraumont Oct 24 '17 at 16:03
  • @Galik Got the error `Permission denied` as expected with your code above. – kaushal Oct 24 '17 at 16:04
  • Added more details about the host – kaushal Oct 24 '17 at 16:07
  • 1
    Maybe helpful: https://stackoverflow.com/questions/2483755/how-to-programmatically-gain-root-privileges – Fantastic Mr Fox Oct 24 '17 at 16:39

0 Answers0