From owner-freebsd-hackers Fri Oct 18 15:52:24 1996 Return-Path: owner-hackers Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id PAA28472 for hackers-outgoing; Fri, 18 Oct 1996 15:52:24 -0700 (PDT) Received: from irz301.inf.tu-dresden.de (irz301.inf.tu-dresden.de [141.76.1.11]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id PAA28447 for ; Fri, 18 Oct 1996 15:52:12 -0700 (PDT) Received: from sax.sax.de (sax.sax.de [193.175.26.33]) by irz301.inf.tu-dresden.de (8.6.12/8.6.12-s1) with ESMTP id AAA08535 for ; Sat, 19 Oct 1996 00:52:01 +0200 Received: (from uucp@localhost) by sax.sax.de (8.6.12/8.6.12-s1) with UUCP id AAA01328 for freebsd-hackers@freebsd.org; Sat, 19 Oct 1996 00:52:00 +0200 Received: (from j@localhost) by uriah.heep.sax.de (8.7.6/8.6.9) id WAA28539 for freebsd-hackers@freebsd.org; Fri, 18 Oct 1996 22:39:59 +0200 (MET DST) From: J Wunsch Message-Id: <199610182039.WAA28539@uriah.heep.sax.de> Subject: Re: fix for symlinks in /tmp (fwd) FYI To: freebsd-hackers@freebsd.org (FreeBSD hackers) Date: Fri, 18 Oct 1996 22:39:59 +0200 (MET DST) Reply-To: joerg_wunsch@uriah.heep.sax.de (Joerg Wunsch) In-Reply-To: <199610181859.UAA14544@spooky.lss.cp.philips.com> from Guido van Rooij at "Oct 18, 96 08:59:09 pm" X-Phone: +49-351-2012 669 X-PGP-Fingerprint: DC 47 E6 E4 FF A6 E9 8F 93 21 E0 7D F9 12 D6 4E X-Mailer: ELM [version 2.4ME+ PL17 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk As Guido van Rooij wrote: > I have created a patch for Linux that fixes the generic problem of > security holes due to symlinks being used in /tmp. > > The patch changes the kernels namei code so that symlinks will not be > followed if: > > 1) the t bit is set on the directory containing the symlink > and > 2) the euid of the process does not match the owner of the symlink. 4.4BSD's symlinks don't have owners at all. -- cheers, J"org joerg_wunsch@uriah.heep.sax.de -- http://www.sax.de/~joerg/ -- NIC: JW11-RIPE Never trust an operating system you don't have sources for. ;-)