Re: creating backups in temporary directories

[David Kastrup <dak@gnu.org>]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

> In a directory with mode 777, that's true: everything is dangerous.
> But in a directory with mode 1777 when you open a file that *you* own,
> nobody else can remove it or rename it, so normally nobody can replace it
> with a symlink.  Emacs creates the problem when it moves /tmp/foo to
> /tmp/foo~ at which point /tmp/foo is free for an attacker to take.

Well, the alternative is to make a hard link of /tmp/foo to /tmp/foo~,
then creat /tmp/foo over it and fill it with contents without
reopening.

That should close the time window for an attack.

Anyway, using O_CREAT|O_EXCL when opening refuses to go through
symbolic links.

So we should have a few options available for avoiding problems.

-- 
David Kastrup, Kriemhildstr. 15, 44793 Bochum