Re: Insecure admin scripts with /tmp temp files
On Thu, 31 Jul 1997, Topi Miettinen wrote:
> There are several administrative programs that use temporary files in /tmp
> without proper checking, resulting in major security holes. To make
> problems worse, many packages have {post,pre}{inst,rm} scripts with the
> same holes.
[... worrisome examples ...]
> Maybe there should be a set of rules for using temp files in security
> critical applications (perhaps in Developers manual or Policy manual). Here
> are a few suggestions:
[... suggestions ...]
How about something like:
TMPDIR=/tmp/$$
mkdir -m 600 $TMPDIR # an error here causes an abort
do_something >$TMPDIR/somefile
[...]
rm -rf $TMPDIR
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-devel-request@lists.debian.org .
Trouble? e-mail to templin@bucknell.edu .
Reply to: