Messages in this thread | | | From | (Alan Cox) | Subject | Re: security warning | Date | Tue, 16 Dec 1997 22:25:26 +0000 (GMT) |
| |
> I think Linux currently allows following a symlink for just about anything > (mkdir(), link()) etc, which is partly just because it's so easy to do > with the new dentry scheme, and it is consistent. Most other unixes seem > to allow symlink following for some things (creat) but not others (mkdir).
One problem is it follows it for a lot more than it used to. Following symlinks on creation is bad. It causes a lot of "symlink traps". 2.0 stamps on the symlink and tough the hacker loses. Its an issue because stuff like sendmail checks for the problem and builds appropriately. That means standard sendmail builds configured on 2.0 and run on 2.1 have exploitable holes for example.
There is a definite security wisdom that following a symlink as the last component of a creation operation is bad. That is
if /foo is a symlink
mkdir /foo/bar is fine mkdir /foo or open("/foo", O_CREAT) should error or remove it
I'll have a look at the stuff if its supposed to be easy to fix 8)
Alan
| |