lkml.org 
[lkml]   [1997]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: security warning
Date
Hi,
Jeffrey Hundstad <jeffrey.hundstad@mankato.msus.edu> writes:
> Isn't this JUST the kind of thing that belongs as a switch in /proc/sys
> somewhere?
>
IMHO the right fix is the symlink protection patch, i.e. do not follow a
symlink if the directory which has the symlink has its t bit set unless
you're the owner of the symlink.

That should fix all those nasty "duh, my creat("/tmp/fubar.012345") deleted
/etc/passwd" holes.

--
Matthias Urlichs
noris network GmbH

\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.075 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site