From owner-freebsd-fs Sat Apr 11 07:33:12 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id HAA06192 for freebsd-fs-outgoing; Sat, 11 Apr 1998 07:33:12 -0700 (PDT) (envelope-from owner-freebsd-fs@FreeBSD.ORG) Received: from mail.cs.tu-berlin.de (root@mail.cs.tu-berlin.de [130.149.17.13]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id HAA06187 for ; Sat, 11 Apr 1998 07:33:10 -0700 (PDT) (envelope-from wosch@cs.tu-berlin.de) Received: from panke.panke.de (anonymous213.ppp.cs.tu-berlin.de [130.149.17.213]) by mail.cs.tu-berlin.de (8.8.8/8.8.8) with ESMTP id QAA05410; Sat, 11 Apr 1998 16:28:27 +0200 (MET DST) Received: (from wosch@localhost) by panke.panke.de (8.8.5/8.6.12) id OAA01011; Sat, 11 Apr 1998 14:51:57 +0200 (MET DST) To: =?koi8-r?B?4c7E0sXKIP7F0s7P1w==?= Cc: freebsd-fs@FreeBSD.ORG Subject: Re: cvs commit: src/sbin/mount mntopts.h mount.8 mount.c src/sys/kern vfs_lookup.c vfs_syscalls.c vfs_vnops.c src/sys/sys mount.h References: <199804081832.LAA04184@freefall.freebsd.org> <19980408224834.38476@nagual.pp.ru> From: Wolfram Schneider Date: 11 Apr 1998 14:51:55 +0200 In-Reply-To: =?koi8-r?B?4c7E0sXKIP7F0s7P1w==?='s message of Wed, 8 Apr 1998 22:48:34 +0400 Message-ID: Lines: 28 Sender: owner-freebsd-fs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org =?koi8-r?B?4c7E0sXKIP7F0s7P1w==?= writes: > On Wed, Apr 08, 1998 at 11:32:00AM -0700, Wolfram Schneider wrote: > > wosch 1998/04/08 11:32:00 PDT > > Modified files: > > sbin/mount mntopts.h mount.8 mount.c > > sys/kern vfs_lookup.c vfs_syscalls.c vfs_vnops.c > > sys/sys mount.h > > Log: > > New mount option nosymfollow. If enabled, the kernel lookup() > > function will not follow symbolic links on the mounted > > file system and return EACCES (Permission denied). > > Why? [moved to freebsd-fs] A security workaround. There was a discussion in freebsd-fs some month ago about this patch and nobody objected. > If you care of /tmp, it can be easily overwritted with TMPDIR env. > variable as peter points. Correctly written programs are not the problem ;-) The *thousends* poorly implemented programs are a security risk. How do you want fix a binary only package, e.g. ORACLE? -- Wolfram Schneider http://www.freebsd.org/~wosch/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-fs" in the body of the message