On Sun, May 12, 2002 at 03:04:01PM -0500, Steve Greenland wrote:
> if (mkdir(Directory, 0700)==0) {
> if (chown(Directory, getuid(), getgid()) < 0) {
> perror(Directory);
> goto fatal;
> }
> break;
> }
>
> That seems correct, and works as expected, but I wanted to check and
> make sure I've not missed something unsafe.
You've completely missed the point of the patch. :) The goal is to allow
the user to edit the crontab file but not to turn it into a symlink or
somesuch. By creating a directory and then chowing it so that the user
can create & remove the files in it, you've lost all the point of
creating the directory in the first place. Try mkdir with permission
mask 0711.
--
Mike Stone
Attachment:
pgp9LYQIfp4uT.pgp
Description: PGP signature