Re: symlinks with permissions

[Pavel Machek <pavel@ucw.cz>]

Hi!


> > Perhaps take a look at Pavel's post describing the attack again?
> 
> Yeah, I did that. It still looks like the complaint is that
> /proc/8675309/fd/3 gives you the ability to gain RW access to
> an object for which you have RW access.
> 
> Look, with hard links and the various mount options available
> today you just can't count on setting the mode on a directory
> to completely protect the files that it references. Look carefully

Look again. I can count on paths if I can prevent mounts and
hardlinks. Mounts are irrelevant as they are root-only, and I was
checking for hardlinks.

> Now, ask me if I think that /proc/8675309/fd/3 is a good idea,
> and we'll have a different discussion, but from an old school

Cool, so we actually agree, and can drop this thread?
								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html