3 ms·
Yep. And for good measure, first open with O_CREAT as tempfile with random name, then rename() it to predictable "foo.lock".
by kees99 11mo ago
Yep. And for good measure, first open with O_CREAT as tempfile with random name, then rename() it to predictable "foo.lock".
- seanhunter 11mo agoYup to both of you. But all of this is to say, running shellscripts as root (in particular) needs to be done with extreme care, because if people forget those precautions when writing C, they sure as heck don’t trouble themselves to do it when they’re writing shell. I remember the time (around 2001-2002) when just about every binary was discovered to have some variant on this exact exploit. I happened to be linux sysadmin for a very large, high-profile set of linux boxes at the time. Happy times.