lkml.org 
[lkml]   [2002]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRE: random PID patch
    Date
    > Sometimes, (well; frequently) programs that create temporary
    > files let the filename depend on their PID. A hacker could use
    > that knowledge. So if you know that the application that
    > you're starting uses the last PID+1, you could make sure that
    > that file already exists or create a symlink with that name or
    > whatsoever causing the application you're starting to do
    > things it's not supposed to. Like forcing suid apps to create
    > a file in the startup-scripts dir. or something.
    TS> How about I create 2^15 symlinks then?
    TS> Really, the only true solution to this problem is to fix the apps.

    True. But until ALL applications are fixed and until this bug is no
    longer written, this patch can help...

    I agree, though, that it should not be implemented in the main-
    kernel. Still, it can be usefull.


    ================================================
    De informatie opgenomen in dit bericht kan vertrouwelijk zijn en
    is uitsluitend bestemd voor de geadresseerde. Indien u dit bericht
    onterecht ontvangt, wordt u verzocht de inhoud niet te gebruiken en
    de afzender direct te informeren door het bericht te retourneren.
    ================================================
    The information contained in this message may be confidential
    and is intended to be exclusively for the addressee. Should you
    receive this message unintentionally, please do not use the contents
    herein and notify the sender immediately by return e-mail.


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:30    [W:4.169 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site