[lkml]   [2002]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Bitkeeper licence issues
On Tue, Mar 19, 2002 at 03:27:59PM -0800, David S. Miller wrote:
> From: Larry McVoy <>
> Date: Tue, 19 Mar 2002 15:25:02 -0800
> Come on Pavel, in order to make this happen, you have to
> a) run the installer as root
> b) know the next pid which will be allocated
> c) put the symlink in /tmp/installer$pid
> Exploit: Make all 65535 $pid simlinks
> It's very exploitable actually, and is similar in vein to
> all the ancient mktemp stuff.

Hey Dave, are you suggesting that no such exploits exist in Red Hat's
rpm system? In order for that to be true, rpm would have to be making
sure that each and every directory along any path that it writes is
not writable except by priviledged users. I just checked, it doesn't.

We can sit here all day and make a big deal out of this, I think it's a
waste of time. I'm not an advocate of insecure software and I'm happy
to close any holes that people think need closing, but you're just
wasting time. This isn't an issue. If you really, really cared, there
is nothing to prevent you from downloading the BK image, unpacking it on
a throwaway machine, back it back up again in a shar file or whatever,
and then installing it.

At some point, people get to take responsibility for their own choices.
Larry McVoy lm at
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:25    [W:0.140 / U:7.264 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site