On Thu, Jan 04, 2001 at 07:14:13PM -0800, Joey Hess wrote: > > Here's one more real fun one. This only works if you are root and /root > is mode 700 and $TMP is set to /root/tmp/: > > root@dragon:~>man man > man: can't create a temporary filename: Permission denied > > So incredibly broken.. here is one that is even more fun as works for any user: [eb@socrates /tmp]$ ls -ld . drwxrwxrwt 6 root root 2048 Jan 4 20:33 . [eb@socrates /tmp]$ cp /usr/share/man/man1/ls.1.gz . [eb@socrates /tmp]$ ls -l ./ls.1.gz -rw-r--r-- 1 eb eb 2271 Jan 4 20:34 ./ls.1.gz [eb@socrates /tmp]$ man ./ls.1.gz ./ls.1.gz: No such file or directory man: can't remove /tmp/zmanZNdPIa: No such file or directory [eb@socrates /tmp]$ gunzip ls.1.gz [eb@socrates /tmp]$ man ./ls.1 Reformatting ls.1, please wait... ... [eb@socrates /tmp]$ this one is the wrapper's fault, it does a chdir() somewhere and then gzip doesn't find the page (since it gets a relative pathname). -- Ethan Benson http://www.alaska.net/~erbenson/
Attachment:
pgpf3HYaJNjSu.pgp
Description: PGP signature