This is the mail archive of the
mailing list for the glibc project.
- To: libc-alpha at sources dot redhat dot com
- Subject: Re: posix/wordexp-tst.sh
- From: "Joseph S. Myers" <jsm28 at cam dot ac dot uk>
- Date: Tue, 10 Oct 2000 11:00:27 +0100 (BST)
> posix/wordexp-tst.sh leaves its output files behind in TMPDIR after
> running, if TMPDIR is set. If TMPDIR were set to a shared directory for
> some reason (e.g. set to /var/tmp because of /tmp being full), the usual
> symlink attacks also apply.
Grepping for /tmp|TMPDIR shows several more /tmp symlink holes that are
open during a glibc make check. Suggestion: always use the build
directory for temporary files during testing, irrespective of TMPDIR.
One runtime issue: the ld.so profiling output file might be opened through
a symlink in /var/tmp; it's probably best to use O_NOFOLLOW if available.
Joseph S. Myers