Bug#508867: still exists I think

[Tim Connors <reportbug@rather.puzzling.org>]

reopen #508867
thanks

Didn't realise the bug was marked as moreinfo.

As much as the kernel is claimed to be fixed, I'm pretty sure I was still
seeing this bug with 2.6.32.  I have quit the job with the machine I
encountered this on, and my other machines are in storage, so I can't
verify for another couple of weeks until I get those machines out of
storage and the interweb connected again.

But can't we just swap the order of the access() and open() as a stopgap
(a stopgap only, since I still believe, as per my third message to this
bug, that the access() is a racy check, I should probably file that as a
separate bug for someone with more of a security-inclination to actually
check)?

That way the vfs cache will definitely be invalidated (by the open), and
the access can still do its (faulty) permissions check on the real user
and bail out before any harm is done.

Both calls in AuGetAddr.c and AuGetBest.c would need be modified, and
don't forget to close auth_file if it was successfully opened, but
access() failed.