Re: security warning

Jeffrey Hundstad (jeffrey.hundstad@mankato.msus.edu)
Tue, 16 Dec 1997 16:50:16 -0600 (CST)


Isn't this JUST the kind of thing that belongs as a switch in /proc/sys
somewhere?

On 16 Dec, Linus Torvalds wrote:
>
>
> On Tue, 16 Dec 1997, Alan Cox wrote:
>>
>> One problem is it follows it for a lot more than it used to. Following symlinks
>> on creation is bad. It causes a lot of "symlink traps". 2.0 stamps on the
>> symlink and tough the hacker loses.
>
> No, 2.0.x also followed symlinks for create(), I'm fairly certain. It used
> to be pretty painful to do, actually, but others did it, and I think
> people even pointed to programs that wanted it done.
>
> But yes, 2.1.x would tend to do it more aggressively for other things than
> just create().
>
>> I'll have a look at the stuff if its supposed to be easy to fix 8)
>
> It really should be a matter of just making a 1 (follow_links) a 0.