Re: CDcontrol software released (
[EMAIL PROTECTED] schrieb am Mittwoch, den 20. Juni 2001:
At the very least use ${HOME}/.tmp.$$
But on many sites there are quotas on $HOME and the space on the HOIME FS
may not allow you to store a CD even if there were no quotas.
It would make sense to be at least able to set the place where /tmp file
go to.
Agreed, but please default to the secure choice.
Walter
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: CDcontrol software released (
On Tue, 19 Jun 2001, Alexander Skwar wrote: So sprach Walter Hofmann am Tue, Jun 19, 2001 at 11:42:15PM +0200: I know what I'm going to choose. Yep, so do I. But still Jörg's point is somewhat valid. If there's no mktemp on the system, a portable way has to be chosen. Even if the portable way is FAR less capable. It all boils down to how portable the thing is supposed to be. Putting the temp file in the user's home directory being the obvious choice. Walter -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: CDcontrol software released (
Joerg Schilling schrieb am Mittwoch, den 20. Juni 2001: You are going to write a security relevant appliaction where people could gain something from attaking the /tmp files. You see, it only applies to suid or sgid applications. So having a script which, when run by a user, can cause the user's mail spool file to be overwritten is not a security problem? If youremove the old file first, you may be close to 100% sure that there is no such problem. Note that many UNIX programs create /tmp/ files and some of them make it easy to know the names in advance. The chance that this happens by accident is, indeed, very small. I was thinking about an attacker who deliberately and repeatedly creates links from files /tmp.123 to /var/spool/mail/username and also creates some additional load to make the window large enough. This seems very feasible for an attacker. Walter -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: CDcontrol software released (
Joerg Schilling schrieb am Mittwoch, den 20. Juni 2001: From [EMAIL PROTECTED] Tue Jun 19 23:25:06 2001 [EMAIL PROTECTED] schrieb am Sonntag, den 17. Juni 2001: Well UNIX _allows_ you to be creative: use /tmp/xx.$$.someting This is a gaping security hole. Especially given that cdrecord is often used as root or setuid root. If you prove me that you gained root privilleges using a recent cdrecord in suid mode, I'll give you a bottle of Champain. Note that I was not claiming that cdrecord has a security hole, but some script. Walter -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
