Re: security warning

Albert D. Cahalan (acahalan@cs.uml.edu)
Tue, 16 Dec 1997 12:50:08 -0500 (EST)


>> I suspect nearly everybody has a security hole on their system.
>> (some of you can guess... please wait a few weeks)
>> I would strongly suggest the following patch:
>> ftp://ftp.fuller.edu/Linux/symlink-attack-patch-2.1.71
>> I hope that patch gets in the kernel soon, default to "Y".
>
> There's been a lot of discussion about this already, pay attention.

Yes, that is where I got the URL. I found a new bug that the
patch would protect against. There too many buggy applications;
we couldn't fix them all even if we had the source code.

> It is not a sure thing, it's easy to get around i've been told,

There was an alternative that was easy to get around.
The original patch would be hard to get around.

> and many complain that it breaks unix standards.
> ie: the symlink in /tmp shit..

Nope, this is standard compliant:

1. The sticky bit on directories has vaguely defined behavior.
Standards tend to add "has appropriate privileges", which
is a way to say "you could be MVS or NT and do weird stuff".

2. Link creation requires undefined "access" -- owner in this case.
Again, it is a way to let strange security policies be legal.

Nobody has shown an application that breaks.