Re: creating backups in temporary directories

[David Kastrup <dak@gnu.org>]

Andreas Schwab <schwab@suse.de> writes:

> David Kastrup <dak@gnu.org> writes:
>
>> Stefan Monnier <monnier@iro.umontreal.ca> writes:
>>
>>> In a directory with mode 777, that's true: everything is dangerous.
>>> But in a directory with mode 1777 when you open a file that *you* own,
>>> nobody else can remove it or rename it, so normally nobody can replace it
>>> with a symlink.  Emacs creates the problem when it moves /tmp/foo to
>>> /tmp/foo~ at which point /tmp/foo is free for an attacker to take.
>>
>> Well, the alternative is to make a hard link of /tmp/foo to /tmp/foo~,
>> then creat /tmp/foo over it and fill it with contents without
>> reopening.
>>
>> That should close the time window for an attack.
>
> You have to unlink the file first,

Well, seems I misread the manual page for open/creat.  I thought that
without O_EXCL, the file would get replaced.

Well, then there still is the contorted way of hard linking /tmp/foo
to /tmp/foo~, opening /tmp/randomfilename for write, renaming it to
/tmp/foo and then finishing the write operation.

-- 
David Kastrup, Kriemhildstr. 15, 44793 Bochum