Re: Fix for ssh-1.2.27 symlink/bind problem

From: Olaf Seibert (rhialtoat_private)
Date: Mon Oct 04 1999 - 03:58:42 PDT

  • Next message: Rosner, D: "FireWall-1 weakness?"

    On Sat, 2 Oct 1999, Scott Gifford wrote:
    
    > +   /* OK, now we know we're in the directory we created.  Nobody can
    > +    * rmdir() this because we are in it.  Nobody besides root can have
    > +    * made a symlink in here, because they wouldn't have permission.
    > +    * Lookin' good...
    > +   **/
    
    Actually, a directory *can* be rmdir()ed when it some process' current
    directory. You can try that with a couple of shells for instance. But
    once the directory is not empty, it cannot be rmdir()ed anymore. Perhaps
    you can use that fact to your advantage.
    
    On the other hand, if you're in an rmdir()ed directory, a chdir ("..")
    or a rename("somename", "../somename") also don't work, and it looks
    like even creation of new files or sockets will fail too, so this could
    probably be used as a detection after the fact.
    
    (all this on NetBSD 1.3.3)
    
    -Olaf.
    --
    ___ Olaf 'Rhialto' Seibert - rhialtoat_private     -- If one tells the truth,
    \X/ .kun.nl          -- one is, sooner or later, to be found out. (Oscar Wilde)
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:06:34 PDT