Re: CVE-2008-5378: possible symlink attacks

2008-12-30 Thread Andreas Tille
On Mon, 29 Dec 2008, Russ Allbery wrote: Right, mkstemp gives you a file name that you can then safely open. In code where I didn't want to break the existing flow, I've used the following pattern many times: fd = mkstemp(filename); if (fd < 0) { perror("mkstemp"); return N

Re: CVE-2008-5378: possible symlink attacks

2008-12-30 Thread Andreas Tille
On Tue, 30 Dec 2008, Thomas Viehmann wrote: Also, mkstemp(3): The last six characters of template must be "XX" and these are replaced with a string that makes the filename unique. Since it will be modified, template must not be a string constant, but should be decl

Re: CVE-2008-5378: possible symlink attacks

2008-12-29 Thread Russ Allbery
Thomas Viehmann writes: > Andreas Tille wrote: >> Args - I've read this and intended to use in both cases mkstemp - but >> then just forgot this. I think just for reading files mktemp is fine. >> The rationale is that I do not really want to rewrite the reading >> routine which opens the file to

Re: CVE-2008-5378: possible symlink attacks

2008-12-29 Thread Thomas Viehmann
Andreas Tille wrote: > On Mon, 29 Dec 2008, Thomas Viehmann wrote: > >> Never use mktemp(). > > Args - I've read this and intended to use in both cases mkstemp - but then > just forgot this. I think just for reading files mktemp is fine. The > rationale is that I do not really want to rewrite

Re: CVE-2008-5378: possible symlink attacks

2008-12-29 Thread Andreas Tille
On Mon, 29 Dec 2008, Thomas Viehmann wrote: Never use mktemp(). Args - I've read this and intended to use in both cases mkstemp - but then just forgot this. I think just for reading files mktemp is fine. The rationale is that I do not really want to rewrite the reading routine which opens

Re: CVE-2008-5378: possible symlink attacks

2008-12-29 Thread Thomas Viehmann
Hi, Andreas Tille wrote: > On Mon, 22 Dec 2008, Thomas Viehmann wrote: > >> Oh, and if you really care, be sure that it's a regular file (not a >> symlink pointing to something) owned by yourself before using it as a >> hint to kill your processes. > > Thanks for your hints. I've prepared a pat

Re: CVE-2008-5378: possible symlink attacks

2008-12-29 Thread Andreas Tille
On Mon, 22 Dec 2008, Thomas Viehmann wrote: Oh, and if you really care, be sure that it's a regular file (not a symlink pointing to something) owned by yourself before using it as a hint to kill your processes. Thanks for your hints. I've prepared a patch at http://svn.debian.org/wsvn/deb

Re: CVE-2008-5378: possible symlink attacks

2008-12-22 Thread Thomas Viehmann
Thomas Viehmann wrote: > Andreas Tille wrote: >> 2. Make the temp file save against symlink attacks. The question >> I have for this case which should probably be prefered is: How >> can I savely teach an independent script about the PIDs of a >> crashed program that should be sto

Re: CVE-2008-5378: possible symlink attacks

2008-12-22 Thread Thomas Viehmann
Hi, Andreas Tille wrote: > 2. Make the temp file save against symlink attacks. The question > I have for this case which should probably be prefered is: How > can I savely teach an independent script about the PIDs of a > crashed program that should be stopped. I think random fi

Re: CVE-2008-5378: possible symlink attacks

2008-12-22 Thread Felipe Sateler
Andreas Tille wrote: > Hi, > > when I started manitaining arb I noticed that the program might crash > under some seldom occurrences. To enable the users to start cleanly > another instance I enhanced the scripts provided by upstream which > basically parse a file containing the PIDs of the main

Re: CVE-2008-5378: possible symlink attacks

2008-12-22 Thread Andreas Tille
Hi, when I started manitaining arb I noticed that the program might crash under some seldom occurrences. To enable the users to start cleanly another instance I enhanced the scripts provided by upstream which basically parse a file containing the PIDs of the main arb processes. These files are s