From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: [PATCH for-4.5] tools/pygrub: Fix TOCTOU race introduced by c/s 63dcc68 Date: Wed, 29 Oct 2014 18:09:31 +0000 Message-ID: <54512D5B.1040003@citrix.com> References: <1414591781-19376-1-git-send-email-andrew.cooper3@citrix.com> <20141029160322.GA22428@aepfle.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20141029160322.GA22428@aepfle.de> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Olaf Hering Cc: Wei Liu , Ian Jackson , Ian Campbell , Xen-devel List-Id: xen-devel@lists.xenproject.org On 29/10/14 16:03, Olaf Hering wrote: > On Wed, Oct 29, Andrew Cooper wrote: > >> In addition, use os.makedirs() which will also create intermediate directories >> if they don't exist. > Can this happen in practice, given that /var/run/xen is created by the > runlevel scripts already? The mkdir is now really just @XEN_RUN_DIR@/pygrub. > > Olaf Yes, although I presume not given the runlevel scripts. XenServer, and Xapi in particular, is very different from an upstream xl based system. It has traditionally had its own initscripts. We are in the process of disentangling these, but it is not a trivial amount of work. The result is that I have positively proved that XenServer hit this race during automatic testing. I agree that it shouldn't happen in reality for a system configured as expected, but that fact alone doesn't invalidate the fix itself. ~Andrew