From owner-svn-src-stable@FreeBSD.ORG Tue Mar 30 15:26:12 2010 Return-Path: Delivered-To: svn-src-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DDB1E1065677; Tue, 30 Mar 2010 15:26:12 +0000 (UTC) (envelope-from jh@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id CC9648FC19; Tue, 30 Mar 2010 15:26:12 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o2UFQC0k017892; Tue, 30 Mar 2010 15:26:12 GMT (envelope-from jh@svn.freebsd.org) Received: (from jh@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o2UFQCYl017890; Tue, 30 Mar 2010 15:26:12 GMT (envelope-from jh@svn.freebsd.org) Message-Id: <201003301526.o2UFQCYl017890@svn.freebsd.org> From: Jaakko Heinonen Date: Tue, 30 Mar 2010 15:26:12 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-6@freebsd.org X-SVN-Group: stable-6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r205883 - stable/6/etc/rc.d X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Mar 2010 15:26:13 -0000 Author: jh Date: Tue Mar 30 15:26:12 2010 New Revision: 205883 URL: http://svn.freebsd.org/changeset/base/205883 Log: MFC r205121: Use an unique directory name instead of hardcoded /tmp/.diskless. A malicious user could create a file named /tmp/.diskless and cause the script to misbehave. PR: conf/141258 Modified: stable/6/etc/rc.d/tmp Directory Properties: stable/6/etc/ (props changed) Modified: stable/6/etc/rc.d/tmp ============================================================================== --- stable/6/etc/rc.d/tmp Tue Mar 30 15:25:16 2010 (r205882) +++ stable/6/etc/rc.d/tmp Tue Mar 30 15:26:12 2010 (r205883) @@ -49,8 +49,8 @@ case "${tmpmfs}" in [Nn][Oo]) ;; *) - if /bin/mkdir -p /tmp/.diskless 2> /dev/null; then - rmdir /tmp/.diskless + if _tmpdir=$(mktemp -d -q /tmp/.diskless.XXXXXX); then + rmdir ${_tmpdir} else if [ -h /tmp ]; then echo "*** /tmp is a symlink to a non-writable area!"