3 ms·

Relevant `unlink` attack: http://lcamtuf.coredump.cx/tmp_paper.txt http://lcamtuf.coredump.cx/tmp_paper.txt

• saurik 14y ago
  This attack is actually not relevant because tmpwatch (the daemon whose behavior causes the problem) runs as root and is calling unlink as root (this is explicitly noted). In fact, /tmp generally does not have the behavior cited by this article, as it is marked with a special access flag that only lets users modify the directory entries of files they own. http://en.m.wikipedia.org/wiki/Sticky_bit http://en.m.wikipedia.org/wiki/Sticky_bit
  • majke 14y ago
    True. Thanks for clarification. Actually, I never understood why "sticky bit" is called that way, wikipedia article gives an answer: The sticky bit was introduced in the Fifth Edition of Unix in 1974 for use with pure executable files. When set, it instructed the operating system to retain the text segment of the program in swap space after the process exited.