unofficial mirror of emacs-devel@gnu.org 
 help / color / mirror / code / Atom feed
From: Al Petrofsky <al@petrofsky.org>
Cc: monnier+gnu/emacs@RUM.cs.yale.edu, Pavel@Janik.cz,
	walters@verbum.org, emacs-devel@gnu.org
Subject: Re: many packages write to `temporary-file-directory' insecurely
Date: Mon, 4 Mar 2002 18:26:40 -0800	[thread overview]
Message-ID: <200203050226.SAA32321@radish.petrofsky.org> (raw)
In-Reply-To: <200203042341.g24NfAA00521@aztec.santafe.edu> (message from Richard Stallman on Mon, 4 Mar 2002 16:41:10 -0700 (MST))

> From: Richard Stallman <rms@gnu.org>

> That code needs comments to explain what it is trying to do and why
> that is right.  After some study, I think I see WHAT it does, but I
> can't see why one would want to do that.

The original problem was that when we wrote over /tmp/snake-scores we
couldn't be sure that /tmp/snake-scores hadn't just been changed from
a file to a symbolic link pointing to one of our important files.

My solution is to first write the scores securely into a temp file and
then move it to the desired place.  This is safe, because if someone
has made the destination filename a symbolic link, then the rename
system call removes the link, rather than overwriting the linked-to
file.

This requires storing the file in a subdirectory of /tmp that is
world-writable without restriction, as opposed to /tmp itself, which
normally has its sticky bit set, thus forbidding people from deleting
others' files or renaming over them.

The catch is that if someone has made /tmp/emacs-game-scores a
symbolic link to one of our directories, then we could overwrite the
file named snake-scores in that directory.  So the improvement is that
only our files named snake-scores are vulnerable, rather than all of
them.

>  It seems to make the file read-only; why do that?

The point of (set-file-modes temp #o444) is to ensure the file is
world-readable, in case the user has a paranoid umask.  Making the
file non-writable is not necessary.

-al

_______________________________________________
Emacs-devel mailing list
Emacs-devel@gnu.org
http://mail.gnu.org/mailman/listinfo/emacs-devel


  reply	other threads:[~2002-03-05  2:26 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2002-03-01  1:15 many packages write to `temporary-file-directory' insecurely Colin Walters
2002-03-02 11:52 ` Pavel Janík
2002-03-02 21:12   ` Colin Walters
2002-03-02 23:13     ` Pavel Janík
2002-03-03 17:18       ` Stefan Monnier
2002-03-03 20:36         ` Al Petrofsky
2002-03-04  0:07           ` Stefan Monnier
2002-03-04 23:41           ` Richard Stallman
2002-03-05  2:26             ` Al Petrofsky [this message]
2002-03-05 15:15               ` Stefan Monnier
2002-03-05 19:57                 ` Al Petrofsky
2002-03-05 21:58               ` Richard Stallman
2002-03-04 23:40         ` Richard Stallman
2002-03-05  4:30           ` Colin Walters
2002-03-05 10:20           ` Andreas Schwab
2002-03-05 15:20             ` Stefan Monnier
2002-03-05 19:07               ` Richard Stallman
2002-03-06  4:40               ` Colin Walters
2002-03-06  7:35                 ` Colin Walters
2002-03-06 16:59                   ` Stefan Monnier
2002-03-07  2:40                     ` Colin Walters
2002-03-07  6:00                       ` Eli Zaretskii
2002-03-08  9:08                   ` Richard Stallman
2002-03-08  9:08                   ` Richard Stallman
2002-03-10 10:46                     ` Colin Walters
2002-03-11  9:01                       ` Richard Stallman
2002-03-17 22:08                         ` Colin Walters
2002-03-18 20:06                           ` Richard Stallman
2002-03-18 22:36                             ` Colin Walters
2002-03-18 23:49                               ` Steve Kemp
2002-03-19  0:31                                 ` Colin Walters
2002-03-19  6:22                                 ` Pavel Janík
2002-03-20  5:10                               ` Richard Stallman
2002-03-27 23:46                                 ` Colin Walters
2002-03-31  1:24                                   ` Richard Stallman
2002-04-05  7:30                                     ` Colin Walters
2002-04-05 23:41                                       ` Richard Stallman
2002-03-06 16:59                 ` Stefan Monnier
2002-03-06 19:05                   ` Colin Walters
2002-03-08  9:07                 ` Richard Stallman
2002-03-08 18:52                   ` Colin Walters
2002-03-09 10:49                     ` Richard Stallman
2002-03-03 14:39   ` Richard Stallman
2002-03-04  4:08 ` Richard Stallman
2002-03-04  4:08 ` Richard Stallman
2002-03-04  4:50   ` Colin Walters

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://www.gnu.org/software/emacs/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200203050226.SAA32321@radish.petrofsky.org \
    --to=al@petrofsky.org \
    --cc=Pavel@Janik.cz \
    --cc=emacs-devel@gnu.org \
    --cc=monnier+gnu/emacs@RUM.cs.yale.edu \
    --cc=walters@verbum.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).