From owner-freebsd-questions  Sat Mar 31 11:40:11 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from clmboh1-smtp3.columbus.rr.com (clmboh1-smtp3.columbus.rr.com [65.24.0.112])
	by hub.freebsd.org (Postfix) with ESMTP id DDD6137B719
	for <freebsd-questions@FreeBSD.ORG>; Sat, 31 Mar 2001 11:40:03 -0800 (PST)
	(envelope-from wmoran@iowna.com)
Received: from iowna.com (dhcp065-024-023-232.columbus.rr.com [65.24.23.232])
	by clmboh1-smtp3.columbus.rr.com (8.11.2/8.11.2) with ESMTP id f2VJbDw03131;
	Sat, 31 Mar 2001 14:37:13 -0500 (EST)
Message-ID: <3AC6415C.CEF6162A@iowna.com>
Date: Sat, 31 Mar 2001 15:43:08 -0500
From: Bill Moran <wmoran@iowna.com>
X-Mailer: Mozilla 4.76 [en] (X11; U; FreeBSD 4.3-RC i386)
X-Accept-Language: en
MIME-Version: 1.0
To: Jan Grant <Jan.Grant@bristol.ac.uk>
Cc: freebsd-questions <freebsd-questions@FreeBSD.ORG>
Subject: Re: access() system call
References: <Pine.GSO.4.31.0103311856010.11771-100000@mail.ilrt.bris.ac.uk>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Jan Grant wrote:
> 
> On Sat, 31 Mar 2001, Bill Moran wrote:
> 
> > Paul Herman wrote:
> > >
> > > On Sat, 31 Mar 2001, Edwin Groothuis wrote:
> > >
> > > > > 2. Is there any more information on why access() is such a terrible
> > > > > security hole?
> > > >
> > > > I'm also wondering about it.
> > >
> > > Just a hunch, but maybe because of a possible race condition between
> > > checking for a file's existence and opening it for use.  fstat(2) is
> > > already passed an open file descriptor so you get the real McCoy.
> > >
> > > The stat(2) and access(2) system calls look as if they do pretty much
> > > the same to me, perhaps stat(2) should also carry such a warning in
> > > the manpage?
> >
> > Interesting, albiet only speculation.
> 
> 'Tis truth; th file you're dealing with may change between access and
> open.

Yes, it is true, I stand corrected.
stat() would also have this possible vulnerability.
The good news is that it's safe to use for the application I need!

Thanks,
Bill

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message