Re: many packages write to `temporary-file-directory' insecurely

[Colin Walters <walters@debian.org>]

[-- Attachment #1: Type: text/plain, Size: 178 bytes --]

How about the following?  One issue still to consider is whether or not
we should default to writing game state in ~/.emacs.d, or in
`temporary-file-directory'.  Any opinions?



[-- Attachment #2: gamestate.patch --]
[-- Type: text/plain, Size: 7027 bytes --]

Index: src/filelock.c
===================================================================
RCS file: /cvsroot/emacs/emacs/src/filelock.c,v
retrieving revision 1.96
diff -u -r1.96 filelock.c
--- src/filelock.c	6 Feb 2002 15:44:28 -0000	1.96
+++ src/filelock.c	6 Mar 2002 07:34:59 -0000
@@ -762,6 +762,7 @@
 {
   DEFVAR_LISP ("temporary-file-directory", &Vtemporary_file_directory,
 	       doc: /* The directory for writing temporary files.  */);
+  /* We initialize this more intelligently later in startup.el */
   Vtemporary_file_directory = Qnil;
 
   defsubr (&Sunlock_buffer);
Index: src/callproc.c
===================================================================
RCS file: /cvsroot/emacs/emacs/src/callproc.c,v
retrieving revision 1.182
diff -u -r1.182 callproc.c
--- src/callproc.c	4 Mar 2002 23:41:00 -0000	1.182
+++ src/callproc.c	6 Mar 2002 07:35:00 -0000
@@ -104,7 +104,7 @@
 #endif
 
 Lisp_Object Vexec_path, Vexec_directory, Vexec_suffixes;
-Lisp_Object Vdata_directory, Vdoc_directory;
+Lisp_Object Vdata_directory, Vdoc_directory, Vgame_state_directory;
 Lisp_Object Vconfigure_info_directory;
 Lisp_Object Vtemp_file_name_pattern;
 
@@ -1534,6 +1534,9 @@
 	}
     }
 
+  /* We initialize this more intelligently later in startup.el */
+  Vgame_state_directory = Qnil;
+  
 #ifndef CANNOT_DUMP
   if (initialized)
 #endif
@@ -1614,6 +1617,11 @@
   DEFVAR_LISP ("data-directory", &Vdata_directory,
 	       doc: /* Directory of machine-independent files that come with GNU Emacs.
 These are files intended for Emacs to use while it runs.  */);
+
+  DEFVAR_LISP ("game-state-directory", &Vgame_state_directory,
+	       doc: /* Directory of high-score and other state files for games.
+Depending on your system setup, this may or may not default to a
+shared directory. */);
 
   DEFVAR_LISP ("doc-directory", &Vdoc_directory,
 	       doc: /* Directory containing the DOC file that comes with GNU Emacs.
Index: lisp/startup.el
===================================================================
RCS file: /cvsroot/emacs/emacs/lisp/startup.el,v
retrieving revision 1.290
diff -u -r1.290 startup.el
--- lisp/startup.el	6 Feb 2002 14:59:10 -0000	1.290
+++ lisp/startup.el	6 Mar 2002 07:35:01 -0000
@@ -653,6 +653,19 @@
 	(if (eq system-type 'ms-dos)
 	    (getenv "TMPDIR")))
 
+  (unless game-state-directory
+    (setq game-state-directory
+	  (let (ret
+		choice
+		(choices (list "/var/games/emacs" "/var/games"
+			       temporary-file-directory)))
+	    (while (and (not ret) (setq choice (car choices)))
+	      (when (and (eq (car (file-attributes choice)) t)
+			 (file-writable-p choice))
+		(setq ret choice))
+	      (setq choices (cdr choices)))
+	    ret)))
+
   ;; See if we should import version-control from the environment variable.
   (let ((vc (getenv "VERSION_CONTROL")))
     (cond ((eq vc nil))			;don't do anything if not set
Index: lisp/play/gamegrid.el
===================================================================
RCS file: /cvsroot/emacs/emacs/lisp/play/gamegrid.el,v
retrieving revision 1.5
diff -u -r1.5 gamegrid.el
--- lisp/play/gamegrid.el	3 Mar 2002 14:13:53 -0000	1.5
+++ lisp/play/gamegrid.el	6 Mar 2002 07:35:02 -0000
@@ -404,27 +404,39 @@
 
 ;; ;;;;;;;;;;;;;;; high score functions ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
-(defun gamegrid-add-score (file score)
-  "Add the current score to the high score file."
+(defun gamegrid-add-score (filename score &optional directory)
+  "Add SCORE to the high score file named FILENAME.
+If DIRECTORY is non-nil, then place the high-score file in that
+directory.  Otherwise, place the high score file in
+`game-state-directory'.
+Note that there is no attempt made to guarantee that all scores will
+be written to the score file if multiple Emacs users are writing to
+the score file using this function at the same time."
   (save-excursion
-  (find-file-other-window file)
-  (setq buffer-read-only nil)
-  (goto-char (point-max))
-  (insert (format "%05d\t%s\t%s <%s>\n"
-		  score
-		  (current-time-string)
-		  (user-full-name)
-		  (cond ((fboundp 'user-mail-address)
-			 (user-mail-address))
-			((boundp 'user-mail-address)
-			 user-mail-address)
-			(t ""))))
-  (sort-numeric-fields 1 (point-min) (point-max))
-    (reverse-region (point-min) (point-max))
-  (goto-line (1+ gamegrid-score-file-length))
-  (delete-region (point) (point-max))
-  (setq buffer-read-only t)
-    (save-buffer)))
+    (let* (buf
+	   (file (expand-file-name filename (or directory game-state-directory)))
+	   (tempfile (make-temp-file file)))
+      (while (setq buf (find-buffer-visiting file))
+	(kill-buffer buf))
+      (with-temp-file tempfile
+	(when (file-exists-p file)
+	  (insert-file-contents file nil nil nil t))
+	(goto-char (point-max))
+	(insert (format "%05d\t%s\t%s <%s>\n"
+			score
+			(current-time-string)
+			(user-full-name)
+			(cond ((fboundp 'user-mail-address)
+			       (user-mail-address))
+			      ((boundp 'user-mail-address)
+			       user-mail-address)
+			      (t ""))))
+	(sort-numeric-fields 1 (point-min) (point-max))
+	(reverse-region (point-min) (point-max))
+	(goto-line (1+ gamegrid-score-file-length))
+	(delete-region (point) (point-max)))
+      (rename-file tempfile file t)
+      (find-file-other-window file))))
 
 ;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
Index: lisp/play/snake.el
===================================================================
RCS file: /cvsroot/emacs/emacs/lisp/play/snake.el,v
retrieving revision 1.8
diff -u -r1.8 snake.el
--- lisp/play/snake.el	3 Mar 2002 16:09:28 -0000	1.8
+++ lisp/play/snake.el	6 Mar 2002 07:35:02 -0000
@@ -82,10 +82,7 @@
 (defvar snake-score-y snake-height
   "Y position of score.")
 
-;; It is not safe to put this in /tmp.
-;; Someone could make a symlink in /tmp
-;; pointing to a file you don't want to clobber.
-(defvar snake-score-file "~/.snake-scores"
+(defvar snake-score-file "snake-scores"
   "File for holding high scores.")
 
 ;; ;;;;;;;;;;;;; display options ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
Index: lisp/play/tetris.el
===================================================================
RCS file: /cvsroot/emacs/emacs/lisp/play/tetris.el,v
retrieving revision 1.7
diff -u -r1.7 tetris.el
--- lisp/play/tetris.el	3 Mar 2002 16:09:28 -0000	1.7
+++ lisp/play/tetris.el	6 Mar 2002 07:35:02 -0000
@@ -150,10 +150,7 @@
 (defvar tetris-score-y (+ tetris-next-y 6)
   "Y position of score.")
 
-;; It is not safe to put this in /tmp.
-;; Someone could make a symlink in /tmp
-;; pointing to a file you don't want to clobber.
-(defvar tetris-score-file "~/.tetris-scores"
+(defvar tetris-score-file "tetris-scores"
 ;; anybody with a well-connected server want to host this?
 ;(defvar tetris-score-file "/anonymous@ftp.pgt.com:/pub/cgw/tetris-scores"
   "File for holding high scores.")