lkml.org 
[lkml]   [2002]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Bitkeeper licence issues
Larry McVoy wrote:
> On Tue, Mar 19, 2002 at 03:27:59PM -0800, David S. Miller wrote:
>
>> From: Larry McVoy <lm@bitmover.com>
>> Date: Tue, 19 Mar 2002 15:25:02 -0800
>>
>> Come on Pavel, in order to make this happen, you have to
>>
>> a) run the installer as root
>> b) know the next pid which will be allocated
>> c) put the symlink in /tmp/installer$pid
>>
>>Exploit: Make all 65535 $pid simlinks
>>
>>It's very exploitable actually, and is similar in vein to
>>all the ancient mktemp stuff.
>
>
> Hey Dave, are you suggesting that no such exploits exist in Red Hat's
> rpm system? In order for that to be true, rpm would have to be making
> sure that each and every directory along any path that it writes is
> not writable except by priviledged users. I just checked, it doesn't.
>
> We can sit here all day and make a big deal out of this, I think it's a
> waste of time. I'm not an advocate of insecure software and I'm happy
> to close any holes that people think need closing, but you're just
> wasting time. This isn't an issue. If you really, really cared, there
> is nothing to prevent you from downloading the BK image, unpacking it on
> a throwaway machine, back it back up again in a shar file or whatever,
> and then installing it.
>
> At some point, people get to take responsibility for their own choices.

BTW> The proper way of using files in /tmp is not to make guessable
filenames in the cathegory /tmp/gangbang$pid!

<TECHING MODE>
Please explore the world of mkstemp() and friends on the manpages
and forget about create() or O_* for this purpose. OK?
As an added bonus you will not break export TMPDIR=~/mybed
and firends for the paranoid users.
</TECHING MODE>

This should be a reflex for someone with such a Sun heritage like you...

And finally - please don't mistake me - I don't think that this issue
is a big deal in this particular case...

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:25    [W:0.107 / U:1.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site