From mboxrd@z Thu Jan 1 00:00:00 1970 Path: quimby.gnus.org!not-for-mail From: Al Petrofsky Newsgroups: gmane.emacs.devel Subject: Re: many packages write to `temporary-file-directory' insecurely Date: Tue, 5 Mar 2002 11:57:45 -0800 Message-ID: <200203051957.LAA01358@radish.petrofsky.org> References: <1014945351.23435.102.camel@space-ghost> <1015103550.7365.17.camel@space-ghost> <200203031718.g23HIKt23295@rum.cs.yale.edu> <200203032036.MAA29961@radish.petrofsky.org> <200203042341.g24NfAA00521@aztec.santafe.edu> <200203050226.SAA32321@radish.petrofsky.org> <200203051515.g25FFop01808@rum.cs.yale.edu> NNTP-Posting-Host: quimby2.netfonds.no X-Trace: quimby2.netfonds.no 1015358826 7631 195.204.10.66 (5 Mar 2002 20:07:06 GMT) X-Complaints-To: usenet@quimby2.netfonds.no NNTP-Posting-Date: 5 Mar 2002 20:07:06 GMT Cc: rms@gnu.org, monnier+gnu/emacs@RUM.cs.yale.edu, Pavel@Janik.cz, walters@verbum.org, emacs-devel@gnu.org Original-Received: from fencepost.gnu.org ([199.232.76.164]) by quimby2.netfonds.no with esmtp (Exim 3.12 #1 (Debian)) id 16iLDG-0001yz-00 for ; Tue, 05 Mar 2002 21:07:06 +0100 Original-Received: from localhost ([127.0.0.1] helo=fencepost.gnu.org) by fencepost.gnu.org with esmtp (Exim 3.33 #1 (Debian)) id 16iL6W-0001xx-00; Tue, 05 Mar 2002 15:00:08 -0500 Original-Received: from radish.petrofsky.org ([216.240.48.33]) by fencepost.gnu.org with esmtp (Exim 3.33 #1 (Debian)) id 16iL4G-0001rz-00; Tue, 05 Mar 2002 14:57:48 -0500 Original-Received: (from al@localhost) by radish.petrofsky.org (8.9.3/8.9.3/Debian 8.9.3-21) id LAA01358; Tue, 5 Mar 2002 11:57:45 -0800 Original-To: monnier+gnu/emacs@RUM.cs.yale.edu In-reply-to: <200203051515.g25FFop01808@rum.cs.yale.edu> (monnier+gnu/emacs@RUM.cs.yale.edu) Errors-To: emacs-devel-admin@gnu.org X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.0.5 Precedence: bulk List-Help: List-Post: List-Subscribe: , List-Id: Emacs development discussions. List-Unsubscribe: , List-Archive: Xref: quimby.gnus.org gmane.emacs.devel:1751 X-Report-Spam: http://spam.gmane.org/gmane.emacs.devel:1751 > From: "Stefan Monnier" > > > My solution is to first write the scores securely into a temp file and > > then move it to the desired place. This is safe, because if someone > > has made the destination filename a symbolic link, then the rename > > system call removes the link, rather than overwriting the linked-to file. > > The idea is alright, but: > > > This requires storing the file in a subdirectory of /tmp that is > > world-writable without restriction, as opposed to /tmp itself, which > > normally has its sticky bit set, thus forbidding people from deleting > > others' files or renaming over them. > > This creates another problem, which comes from the fact that Emacs does > not have the notion of file descriptor: an attacker can change the > temp file into a symlink between the call to make-temp-file and the call > to write-region. The temp file is created directly in /tmp, which has sticky bit protection, thus preventing an attacker from changing the temp file into a symlink. If /tmp does not have sticky bit protection, then all uses of make-temp-file are insecure. > I really think it's better to require that the parent directory > of the file we're writing to is only writable by ourselves and/or > by root. I agree, but it doesn't have to be root. If joe user installs emacs with --prefix=/home/joe and the install process makes a world-writable snake-scores file in directory /home/joe/var/emacs/game-scores, which is unwritable by anyone but joe, then that is sufficient. Anyone who uses the binaries has to trust joe anyway. -al _______________________________________________ Emacs-devel mailing list Emacs-devel@gnu.org http://mail.gnu.org/mailman/listinfo/emacs-devel