The debian-private mailing list leak, part 1. Volunteers have complained about Blackmail. Lynchings. Character assassination. Defamation. Cyberbullying. Volunteers who gave many years of their lives are picked out at random for cruel social experiments. The former DPL's girlfriend Molly de Blanc is given volunteers to experiment on for her crazy talks. These volunteers never consented to be used like lab rats. We don't either. debian-private can no longer be a safe space for the cabal. Let these monsters have nowhere to hide. Volunteers are not disposable. We stand with the victims.
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: /tmp usage and security

Then the fix for the updatedb problem should be for sort to tmpfile.
The man page and info page for tmpfile do not mention that the file is 
deleted immediately, merely that it is deleted when closed or when the 
program is terminated.  It would be nice to have a more explicit
explanation.

Of course, the creation/deletion is not an atomic operation.  If there 
is a risk without tmpfile, then the risk remains with tmpfile, though
the risk is reduced because of the smaller window.  A setuid program,
in which the cracker can repeat execution of the problem, may still
remain a significant risk.

bruce@pixar.com (Bruce Perens) writes:

> From: mennucci@cibs.sns.it (Andrea Mennucci)
> > char *good_temp_filename(char *name)
> > this function, given a name, builds a good filename for a file in /tmp/
> > using name as a prefix
> 
> Please see mkstemp(3), tmpnam(3), tempnam(3), and tmpfile(3).
> 
> Of them, the best is tmpfile(), because it creates a unique temporary file
> and _immediately_deletes_it_ while still holding an open file descriptor on
> it, so that you can only access it via its file descriptor and nobody else
> can open it. When your process dies or you close the file descriptor, the
> file's storage is deallocated.
> 


-- 
Kevin Dalley
kevin@aimnet.com


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-private-request@lists.debian.org . 
Trouble?  e-mail to templin@bucknell.edu .