Date: Sat, 10 Mar 2001 23:08:43 -0800 From: Greg White <gregw-freebsd-security@greg.cex.ca> To: FreeBSD Security <freebsd-security@freebsd.org> Subject: Re: temp files for security/logcheck Message-ID: <20010310230843.A26101@greg.cex.ca> In-Reply-To: <20010310225345.A14180@mollari.cthul.hu>; from kris@obsecurity.org on Sat, Mar 10, 2001 at 10:53:46PM -0800 References: <200103110435.f2B4ZHw04676@ns1.unixathome.org>; <20010310234519.A68252@databits.net> <200103110447.f2B4lww04741@ns1.unixathome.org> <20010310225345.A14180@mollari.cthul.hu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Mar 10, 2001 at 10:53:46PM -0800, Kris Kennaway wrote:
> On Sun, Mar 11, 2001 at 05:47:58PM +1300, Dan Langille wrote:
> > AFAIK, the files disappear each time the script is run:
> >
> > umask 077
> > rm -f $TMPDIR/check.$$ $TMPDIR/checkoutput.$$
>
> [...]
>
> Blah, that's an insecure way to create files in $TMPDIR (which is
> usually /tmp). It needs to use mktemp(1).
>
> Kris
It is in general, but not in this case. The script and the directory are
mode 0700 -- this makes it difficult for it to be insecure. $TMPDIR is
explicitly set.
--
Greg White
Those who make peaceful revolution impossible will make violent
revolution inevitable.
-- John F. Kennedy
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010310230843.A26101>