[lkml]   [2003]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: hard links create local DoS vulnerability and security problems
    Quote from Andy Lutomirski <>:
    > wrote:
    > >
    > > In any case, if a user is *MAKING* a program set-UID, it's probably because
    > > he *wants* it to run as himself even if others invoke it (otherwise, he
    > > could just leave it in ~/bin and be happy). So this is really a red herring,
    > > as it's only a problem if (a) he decides to get rid of the binary, and fails
    > > to do so because of hard links he doesn't know about, or (b) he's an idiot
    > > programmer and it malfunctions if invoked with an odd argv[0]....
    > Right... but non-privileged users _can't_ delete these extra links, even
    > if they notice them from the link count.

    They can truncate the file to zero length, though, then delete the
    'original' link, making all of the other links point to the zero
    length file.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:58    [W:0.028 / U:9.904 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site