lkml.org 
[lkml]   [1997]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: security warning
    Date
    > I would strongly suggest the following patch:
    > ftp://ftp.fuller.edu/Linux/symlink-attack-patch-2.1.71
    > I hope that patch gets in the kernel soon, default to "Y".

    Why do we want a patch breaking symbolic links and several applications.
    Fix the applications or fix the use of /tmp even better still.

    There is a symlink bug in 2.1.x but this isnt it. The one that needs fixing
    is open O_EXCL and O_CREAT ahouldnt follow or ignore existing symlinks
    dangling or otherwise. That broke somewhere with dentries and hasnt yet
    got fixed to be correct as 2.0 is. Without this sendmail and stuff arent
    terribly secure on 2.1.x.

    That shouldnt be too hard to fix

    Alan


    \
     
     \ /
      Last update: 2005-03-22 13:40    [W:0.025 / U:20.256 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site