1. Forum
  2. Usenet
  3. COMP.UNIX.PROGRAMMER

  • create temporary files (was: security by kees-cookity [rant])

    From Rainer Weikusat@21:1/5 to Keith Thompson on Thu May 30 12:53:36 2024
    Keith Thompson <[email protected]> writes:
    Rainer Weikusat <[email protected]> writes:
    [email protected] (Scott Lurndal) writes:
    Nicolas George <nicolas$[email protected]> writes: >>>>[email protected], dans le message <v36kd8$11r1b$[email protected]>, >>>> a écrit :
    The simple answer being that no process uses /tmp unless it needs to share
    data with another via files.

    So where should they put their temporary files?

    $ mkdir ${TMPDIR}/${LOGNAME} && chown 1700 ${TMPDIR}/${LOGNAME}

    Note that /tmp and /var/tmp usually have the "Sticky" mode bit
    set which limits the operations that a non-owner can
    perform on a file in that directory.

    This solves only half of the problem: mkdir will fail if the given
    filesystem name already exists. Some scheme to create unguessable names
    and try using them until success would still be needed on top of that.

    `mkdir -p` solves that part of the problem.

    That's not a problem. It's an important featue of a partial solution.

    But what if somebody else
    has created a directory whose name happens to match your ${LOGNAME}?
    It's a convention that works only if everyone follows it.

    As Scott Lurndal points out, this is what mktemp(1) is for.

    Or mkstemp or tmpfile. On Linux (since 3.11), there's also an O_TMPFILE
    open flag which creates a namless open file in some directory (passed as pathname argument to open). It's also not really complicated to do this
    with plain open:

    1. Generate a 'hard to guess' name
    2. Try opening with O_CREAT | O_EXCL
    3. Success? => return fd
    4. goto 1

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Scott Lurndal@21:1/5 to Rainer Weikusat on Thu May 30 13:55:57 2024
    Rainer Weikusat <[email protected]> writes:
    Keith Thompson <[email protected]> writes:
    Rainer Weikusat <[email protected]> writes:
    [email protected] (Scott Lurndal) writes:
    Nicolas George <nicolas$[email protected]> writes: >>>>>[email protected], dans le message <v36kd8$11r1b$[email protected]>, >>>>> a écrit :
    The simple answer being that no process uses /tmp unless it needs to share
    data with another via files.

    So where should they put their temporary files?

    $ mkdir ${TMPDIR}/${LOGNAME} && chown 1700 ${TMPDIR}/${LOGNAME}

    Note that /tmp and /var/tmp usually have the "Sticky" mode bit
    set which limits the operations that a non-owner can
    perform on a file in that directory.

    This solves only half of the problem: mkdir will fail if the given
    filesystem name already exists. Some scheme to create unguessable names
    and try using them until success would still be needed on top of that.

    `mkdir -p` solves that part of the problem.

    That's not a problem. It's an important featue of a partial solution.

    But what if somebody else
    has created a directory whose name happens to match your ${LOGNAME}?
    It's a convention that works only if everyone follows it.

    As Scott Lurndal points out, this is what mktemp(1) is for.

    Or mkstemp or tmpfile. On Linux (since 3.11), there's also an O_TMPFILE
    open flag which creates a namless open file in some directory (passed as >pathname argument to open). It's also not really complicated to do this
    with plain open:

    1. Generate a 'hard to guess' name
    2. Try opening with O_CREAT | O_EXCL
    3. Success? => return fd
    4. goto 1

    0. Use the mkdirat(2) system call rather than mkdir(2) when
    creating the subdirectory in ${TMPDIR:-/tmp}. It may
    be that the library functions backing mktemp et al already do
    this...

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)