From: Andreas Schwab <schwab@suse.de>
To: Brent Casavant <bcasavan@sgi.com>
Cc: linux-kernel@vger.kernel.org
Subject: Re: O_NOLINK for open()
Date: Wed, 12 Sep 2007 23:42:37 +0200 [thread overview]
Message-ID: <jetzpza7ci.fsf@sykes.suse.de> (raw)
In-Reply-To: <20070912144128.D5573@pkunk.americas.sgi.com> (Brent Casavant's message of "Wed\, 12 Sep 2007 15\:37\:44 -0500 \(CDT\)")
Brent Casavant <bcasavan@sgi.com> writes:
> I could mmap a temporary tmpfs file (tmpfs so that if there is a
> machine crash no sensitive data persists) which is created with
> permissions of 0, immediately unlink it, and pass the file
> descriptor through an AF_UNIX socket. This does open up a very
> small window of vulnerability if another process is able to chmod
> the file and open it before the unlink.
Only the owner can chmod a file, so why is that a vulnerability?
Andreas.
--
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
next prev parent reply other threads:[~2007-09-12 22:04 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-09-12 20:37 O_NOLINK for open() Brent Casavant
2007-09-12 21:07 ` H. Peter Anvin
2007-09-12 21:39 ` Brent Casavant
2007-09-12 21:46 ` H. Peter Anvin
2007-09-12 21:42 ` Andreas Schwab [this message]
2007-09-12 22:44 ` Brent Casavant
2007-09-12 22:49 ` Al Viro
2007-09-12 23:27 ` Brent Casavant
2007-09-12 23:48 ` Brent Casavant
2007-09-14 16:37 ` Goswin von Brederlow
2007-09-13 10:08 ` Gabor Gombas
2007-09-13 16:05 ` Brent Casavant
[not found] <92Haf-7z7-5@gated-at.bofh.it>
2007-09-12 22:33 ` Bodo Eggert
2007-09-13 9:13 ` Jan Kara
2007-09-14 9:07 ` Bodo Eggert
[not found] ` <92TO5-246-1@gated-at.bofh.it>
[not found] ` <92Zqu-2ur-1@gated-at.bofh.it>
2007-09-14 10:30 ` Bodo Eggert
2007-09-14 10:50 ` Andreas Schwab
2007-09-14 17:26 ` Bodo Eggert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=jetzpza7ci.fsf@sykes.suse.de \
--to=schwab@suse.de \
--cc=bcasavan@sgi.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox