time of check, time of use issue with SWC_LAUNCH_REQUEST_OPEN_DEVICE

[coypoop]

This is under the assumption that launch and libswc are separate processes for privilege separation (I am not sure if this is true)

1. libswc makes request SWC_LAUNCH_REQUEST_OPEN_DEVICE with (say) a valid DRM_MAJOR
2. stat(...) is used to check it's DRM_MAJOR
3. libswc quickly swaps the pathname for another file
4. open(...) is now done on something that isn't a DRM_MAJOR, and maybe can be abused.

using open THEN fstat eliminates the TOCTOU issue (if this is a security check).

[michaelforney]

Should be fixed now. Thanks for reporting the issue!