Re: Uploaded devscripts 2.0.0 (source all) to master
Martin Bialasinski wrote:
> With touch you mean the create? With the pseudocode creat, I mean
> something like (here in Perl): open OUT, ">def" or die "security
> violation";
>
> Still a problem ?
Yes.
> But we are talking about a user running this script. If he has created
> the file, noone else can remove it (if he hasn't the permission to do
> so). And if one can do this, then permissions on /tmp are broken and
> this is another story.
The point is that a normal open command doesn't necessarily create a file.
If the file exists and is a symlink, it follows the symlink and opens the
file. You have to use the O_CREAT and O_EXCL flags to open(2) to be safe.
--
see shy jo
Reply to: