3 ms·

And? How does that do it?

• IshKebab 2y ago
  I checked. It fopen's the file and then fstat's it. So it isn't vulnerable to TOCTOU. However the TOCTOU is completely benign here. It's just an extra check before Rust opens the file so if you were to try to "exploit" it the only thing that would happen is you get a different error message.
  • oguz-ismail 2y ago
    > if you were to try to "exploit" it the only thing that would happen is you get a different error message Can't reproduce this. If I do sudo strace -e inject=stat:delay_exit=30s:when=2 ./coreutils more foo on one terminal and rm foo ln -s /etc/passwd foo on another, I can see the contents of /etc/passwd on the first one.
    • IshKebab 2y ago
      Uhm yeah well now try ln -s /etc/passwd foo sudo more foo OMG! The original version is "vulnerable" too! (I did not know about that strace feature though - that is very cool, thanks!)
      • oguz-ismail 2y ago
        I thought I was gonna see an error because the stat'd file and the opened one didn't match. How disappointing
        • IshKebab 2y ago
          No, it just means you're checking the wrong file so you might not get the nice error message from the initial check. It's still not going to do anything incorrect when it comes to actually open the file though. TOCTOU only matters when the check is actually checking something important. Here it isn't; it's just giving nicer error messages. If you bypass it you just lose those nice error messages. So it isn't a problem here.