Messages in this thread | | | Subject | Re: [linux-security] Re: t bit and symlinks patch | Date | Sat, 19 Oct 1996 17:29:32 -0500 (CDT) | From | (Igor Chudov @ home) |
| |
Andrew Tridgell wrote: > > Alan wrote: > > Nice idea. IMHO however the fix is to stop people writing applications > > that use /tmp for everything. /tmp was a great idea once upon a time. Its > > value nowdays is a bit questionable. Better that daemons use /var/run > > and applications $HOME/.files > > I generally agree, its just that I think its hard to actually change > all those programs (and programmers) out there that use /tmp. > > I also think that the change does in fact breath new life into > /tmp. Are there any /tmp related security holes that it doesn't fix? > There probably are some, its just that I can't think of them right > now. > > Anyway, I've updated my patch slightly. I changed it so that symlinks > owned by root are not affected. This is safe and means it breaks less > things. > > With my original patch I found that one thing broke on my mail > server. I had a link called "tridge" owned by root in /var/spool/mail > that pointed to /home/tridge/InBox (due to a transition in mailer > behaviour). I also had /var/spool/mail world writeable with the t bit > set. My original patch meant I couldn't run programs that referenced > /var/spool/mail/tridge. > > This is now the active bit of the patch: > > if (S_ISLNK(inode->i_mode) && (dir->i_mode & S_ISVTX) && > inode->i_uid != 0 && > current->fsuid != inode->i_uid) { > iput(dir); > iput(inode); > *res_inode = NULL; > return -EPERM; > } >
I apologize if my comment is incorrect, but as I understand, you do the following: if the directory has bit 't' set and the user does not own the file that the symlink points to, your patch does not allow to follow the symlink.
Suppose that I am a hacker on a system with your patch applied. Suppose my goal is to create a symlink from /tmp/abc to /.rhosts (for example). That is, I would like to
$ ln -fs /.rhosts /tmp/abc
Since you do not allow me to do that, I do the following:
$ ln -fs /.rhosts $HOME/xyz $ ln -fs $HOME/xyz /tmp/abc
Wouldn't that fool your function?
igor
> > the full patch is available from > ftp://samba.anu.edu.au/pub/linux/symlink.patch > > Cheers, Andrew >
- Igor.
| |