Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

Re: [PATCH] Re: Insecure tempfile creation

On Wed, Jan 7, 2015 at 2:03 PM, Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx> wrote:
> Coming back to this, it has occurred to me that
>
>         mv -f =(:) ${TMPPREFIX:-/tmp/zsh}foo$$
>
> wouldn't perform an atomic rename (as intended) if /tmp/zshfoo$$ is a
> directory or symlink-to-directory.  So hypothetically an attacker might
> be able to create a file named `basename =(:)` in a directory of his
> choice owned by the victim.

Hmm.  Yup, we need "ln -Fh" instead of "mv -f".  Are the -F and -h
options of "ln" fairly standard?
Messages sorted by: Reverse Date, Date, Thread, Author