[lkml]   [2002]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Bitkeeper licence issues
    On Tue, Mar 19, 2002 at 03:27:59PM -0800, David S. Miller wrote:
    > From: Larry McVoy <>
    > Date: Tue, 19 Mar 2002 15:25:02 -0800
    > Come on Pavel, in order to make this happen, you have to
    > a) run the installer as root
    > b) know the next pid which will be allocated
    > c) put the symlink in /tmp/installer$pid
    > Exploit: Make all 65535 $pid simlinks
    > It's very exploitable actually, and is similar in vein to
    > all the ancient mktemp stuff.

    Hey Dave, are you suggesting that no such exploits exist in Red Hat's
    rpm system? In order for that to be true, rpm would have to be making
    sure that each and every directory along any path that it writes is
    not writable except by priviledged users. I just checked, it doesn't.

    We can sit here all day and make a big deal out of this, I think it's a
    waste of time. I'm not an advocate of insecure software and I'm happy
    to close any holes that people think need closing, but you're just
    wasting time. This isn't an issue. If you really, really cared, there
    is nothing to prevent you from downloading the BK image, unpacking it on
    a throwaway machine, back it back up again in a shar file or whatever,
    and then installing it.

    At some point, people get to take responsibility for their own choices.
    Larry McVoy lm at
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:25    [W:0.022 / U:22.220 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site