Skip site navigation (1) Skip section navigation (2)

Re: [COMMITTERS] pgsql/src/bin/initdb

From: Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us>
To: Peter Eisentraut <peter_e(at)gmx(dot)net>
Cc: PostgreSQL-development <pgsql-hackers(at)postgreSQL(dot)org>
Subject: Re: [COMMITTERS] pgsql/src/bin/initdb
Date: 2001-06-24 21:18:34
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-committerspgsql-hackers
> Bruce Momjian writes:
> > This brings up a question.  If I have pid 333 and someone creates a file
> > world-writable called /tmp/333, and I go and do:
> >
> > 	cat file >/tmp/$$
> >
> > isn't another user now able to modify those temp file contents.  Is that
> > the insecurity you mentioned Peter, and if so, how do you prevent this?
> That is one possibility.  Another exploit is with a symlink from /tmp/333
> to a file you want to overwrite.  This is more fun with root, but it's
> still not a good idea here.
> To securely create a temp file in shell you need to use mktemp(1), or do
> something like (umask 077 && mkdir $TMPDIR/$$) to create a subdirectory.
> Needless to say, it's tricky.

Wow, that symlink is a bad one.  I don't see mktemp(1) on bsd/os, only
mktemp(3).  I do see it on FreeBSD.

Good thing I don't have other shell users on my system.  I do cat
>/tmp/$$ all the time in scripts.

  Bruce Momjian                        |
  pgman(at)candle(dot)pha(dot)pa(dot)us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026

In response to


pgsql-hackers by date

Next:From: John MooreDate: 2001-06-24 21:38:58
Subject: Re: JDBC Connection State Management with SQL Exceptions (esp Postgresql)
Previous:From: Bruce MomjianDate: 2001-06-24 21:08:10
Subject: Re: Why would this use 600Meg of VM?

pgsql-committers by date

Next:From: Bruce Momjian - CVSDate: 2001-06-25 01:54:00
Subject: pgsql/src/interfaces/jdbc/org/postgresql/jdbc2 ...
Previous:From: Peter EisentrautDate: 2001-06-24 11:25:12
Subject: Re: pgsql/src/bin/initdb

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group