[lkml]   [1996]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectProposal: restrict link(2)

The possiblities of playing around with symlinks in /tmp are well
known and understood.

However, there are also many things which can go wrong with publically
writable directories, such as /tmp, when hard links are employed.

Consider a (questionable) root-owned program which does a
chown("/tmp/foo", uid, gid), with the sticky bit set on /tmp.

If /tmp/foo is a symbolic link to /etc/passwd, all is well with Linux -
it changes the ownership of the symbolic link (which is meaningless in
most cases), and /etc/passwd still belongs to root.

If, however, /tmp/foo is a HARD link to /etc/passwd, chown("/tmp/foo",
uid, gid) will lead to the user owning /etc/passwd - not a desirable
thing, in general.

My proposal would be to disallow linking a file into a directory which
has the sticky bit set unless the owner of the file is attempting this.
In other words, Joe Random Cracker can't do a 'ln /etc/passwd /tmp/foo'

Thomas Koenig,, ig25@dkauni2.bitnet.
The joy of engineering is to find a straight line on a double
logarithmic diagram.

 \ /
  Last update: 2005-03-22 13:38    [W:0.223 / U:1.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site