Messages in this thread |  | | From | Andrew Tridgell <> | Subject | Re: [linux-security] Re: t bit and symlinks patch | Date | Mon, 21 Oct 1996 23:22:55 +1000 |
| |
Igor wrote: > I apologize if my comment is incorrect, but as I understand, you do > the following: if the directory has bit 't' set and the user does not > own the file that the symlink points to, your patch does not allow to > follow the symlink.
No, not quite. The decision is made on whether the user owns the symlink, not if they own the file that it points at.
Luckily Linux does have the concept of the owner of a symlink. Apparently BSD4.4 doesn't have this concept so they would need a different approach to this problem.
> Suppose that I am a hacker on a system with your patch applied. Suppose > my goal is to create a symlink from /tmp/abc to /.rhosts (for example). > That is, I would like to > > $ ln -fs /.rhosts /tmp/abc > > Since you do not allow me to do that, I do the following: > > $ ln -fs /.rhosts $HOME/xyz > $ ln -fs $HOME/xyz /tmp/abc > > Wouldn't that fool your function?
No, because the symlink will be owned by you, so root (and other users) won't follow it. It doesn't matter what file it points at.
Andrew
|  |