[PATCH] OpenSSL: Validate PKCS#11/OpenSC engine and module paths before loading

[Jouni Malinen]

On Mon, Jul 13, 2026 at 10:49:43AM +0800, Tu Naichao wrote:
> The PKCS#11 engine, PKCS#11 module, and OpenSC engine shared object paths
> configured for EAP TLS are passed to OpenSSL, which dlopen()s them within the
> wpa_supplicant/hostapd process. Since these paths can originate from sources
> outside the administrator's direct control (for example the
> SetPKCS11EngineAndModulePath D-Bus method), validate them before loading as a
> defense-in-depth measure.
> 
> Add a tls_engine_path_trusted() helper that resolves the path with realpath()
> and verifies that the target is a regular file owned by root, not writable by
> group or others, and that every ancestor directory up to the file is itself a
> directory, owned by root and not writable by group or others. lstat() is used
> for the file check so that a symlink is never followed. Any failure is treated
> as untrusted and the load is skipped.
> 
> This avoids loading a shared library from an unexpected location while keeping
> legitimately installed, root-owned engine libraries working unchanged.

This might be a reasonable thing to do in some cases, but this could
also potentially break cases where wpa_supplicant is run under a
non-root UID and the shared libraries are in a custom directory and
owned by that non-root UID. In other words, this type of enforcement
should most likely be conditional on something. As an example, it could
a command line argument to wpa_supplicant or a build CONFIG_* option.

-- 
Jouni Malinen                                            PGP id EFC895FA