From owner-freebsd-bugs@FreeBSD.ORG Fri May 13 12:00:23 2005 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 142E716A4CE for ; Fri, 13 May 2005 12:00:23 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id DC79843D48 for ; Fri, 13 May 2005 12:00:22 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j4DC0Mun003180 for ; Fri, 13 May 2005 12:00:22 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j4DC0M6P003179; Fri, 13 May 2005 12:00:22 GMT (envelope-from gnats) Date: Fri, 13 May 2005 12:00:22 GMT Message-Id: <200505131200.j4DC0M6P003179@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: Giorgos Keramidas Subject: Re: conf/80907: tmpmfs default change X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Giorgos Keramidas List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 May 2005 12:00:23 -0000 The following reply was made to PR conf/80907; it has been noted by GNATS. From: Giorgos Keramidas To: aeonflux Cc: bug-followup@freebsd.org Subject: Re: conf/80907: tmpmfs default change Date: Fri, 13 May 2005 14:55:59 +0300 On 2005-05-12 17:10, aeonflux wrote: >On May 12, 2005 09:59 am, Giorgos Keramidas wrote: >> On 2005-05-11 17:38, Caitlen wrote: >> > by default >> > tmpmfs_flags="-S" >> > When in reality >> > tmpmfs_flags="-S -o nosymfollow,nosuid" >> > >> > would be much safer >> >> I don't think this is really a bug, but anyway. It would probably be >> safer to use: >> >> tmpmfs_flags="-S -o noatime,noexec,nosuid,nosymfollow" >> >> The ability to actually *use* whatever options are best for your system >> is exactly why I made the original change to rc.d/tmp, but I'm not sure >> if it would be good to enforce so strict permissions to everyone :-/ > > Good point, but I do think a nosymfollow is a good default. There's really no > reason to allow /tmp symlink race conditions to happen. SInce it's a memory > fs, disabling atime doesn't really make a big difference. > > Anyways just a suggestion, I'll be definitely setting nosymfollow on my > machine here. I'm a bit worried about giving a false sense of "secure default setup", by having /tmp mounted as "nosymfollow". Users who are determined to attempt symlink race hacks may also set TMPDIR=/var/tmp or even TMPDIR=/home/smartass/tmp and try their luck there. Mounting both /tmp and /var as nosymfollow runs the risk of crippling everyone's use of the file systems without actually being a 100% bulletproof solution. - Giorgos