CERT C: Rec. POS02-C

R2026b

Follow the principle of least privilege

Since R2026b

Description

Follow the principle of least privilege¹

Polyspace Implementation

Polyspace^® checks for the issue Call to function with elevated privileges.

Examples

Call to function with elevated privileges

Issue

This issue occurs when a sensitive function is called without a prior call to setuid() to drop elevated privileges.

By default, Polyspace checks calls to these functions:

• fork()

• fopen()

• execve()

You can extend this list by using the behavior EXCEPT_LOW_PRIVILEGE in a code behavior XML file and then specifying the file as an input to the option -code-behavior-specifications.

Risk

Running sensitive operations with elevated privileges increases the attack surface of the program. If an attacker exploits a vulnerability in the privileged code path, they can gain access with the full elevated permissions instead of a restricted set.

Fix

Call setuid() with a non-null argument before invoking any function that does not require elevated privileges. For example, setuid(getuid()) drops privileges to the real user ID. As a best practice, verify that the call to setuid() succeeds.

Example — Calling fopen() with elevated privileges

In this example, the program calls fopen() while still running with elevated privileges. An attacker who controls the file path argument can read or modify protected files.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define APP_HOME "/home/app"

int main(int argc, char* argv[]) {
    chroot(APP_HOME);
    chdir("/");

    FILE* f = fopen(argv[1], "r+");    // Noncompliant
    if (!f) {
        perror("fopen");
        return 1;
    }
    fclose(f);

    return 0;
}

Correction — Drop privileges before calling fopen()

This code call setuid() with a non-null argument to drop privileges before calling a sensitive function like fopen()

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define APP_HOME "/home/app"

int main(int argc, char* argv[]) {
    chroot(APP_HOME);
    chdir("/");

    setuid(getuid());    

    FILE* f = fopen(argv[1], "r+");    // Compliant
    if (!f) {
        perror("fopen");
        return 1;
    }
    fclose(f);

    return 0;
}

Check Information

Group: Rec. 50. POSIX (POS)

PQL Name: std.cert.POS02_C

Version History

Introduced in R2026b