bug-gnu-utils
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Bug#278283: insecure temporary file usage in gettextize and autopoin


From: Bruno Haible
Subject: Re: Bug#278283: insecure temporary file usage in gettextize and autopoint (fwd)
Date: Tue, 26 Oct 2004 20:37:01 +0200
User-agent: KMail/1.5

Alexandre Duret-Lutz wrote:

> Why do you call this unsecure?  Either the directory already exists
> and your script aborts, or the directory is created with safe permissions.

You're right, sorry. I was confused by the presence of $RANDOM. Now I see
that the purpose of $RANDOM is only to decrease the probability of failure,
not to increase security: Creating a directory with mode 077 is all that's
needed for security.

> > It would be nice if we could write up the result of this discussion, when
> > finished, in the autoconf manual.
> > http://www.gnu.org/software/autoconf/manual/autoconf-2.57/html_chapter/autoconf_10.html
>
> Would be helpful, unless it boils down to "use AS_TMPDIR".

Well, there are uses of shell scripts outside of autoconf. autoconf.info
chapter 10 is also a valuable handbook for them. References to AS_* macros
are less useful in this context.

How about this?

*** autoconf/doc/autoconf.texi.bak      2004-10-12 13:50:46.000000000 +0200
--- autoconf/doc/autoconf.texi  2004-10-26 20:30:58.000000000 +0200
***************
*** 11581,11586 ****
--- 11581,11623 ----
  older versions are not thread-safe either).
  
  
+ @item @command{mktemp}
+ @c -------------------
+ @prindex @command{mktemp}
+ @cindex Creating temporary files
+ The command @command{mktemp} exists only on a few systems.  A portable
+ way to create a temporary file name into which it is safe to write,
+ protecting against symlink attacks, is to create a temporary directory
+ with mode 700 and use a file inside this directory.
+ 
+ Here is sample code to securely create a temporary directory:
+ 
+ @example
+ # Use the environment variable TMPDIR, falling back to /tmp. This allows
+ # users to specify a different temporary directory, for example, if their
+ # /tmp is filled up or too small.
+ : address@hidden/address@hidden
+ @{
+   # Use the mktemp program if available. If not available, hide the error
+   # message.
+   tmp=`(umask 077 && mktemp -d -q "$TMPDIR/fooXXXXXX") 2>/dev/null` &&
+   test -n "$tmp" && test -d "$tmp"
+ @} ||
+ @{
+   # Use a simple mkdir command. It is guaranteed to fail if the directory
+   # already exists.  $RANDOM is bash specific and expands to empty in shells
+   # other than bash.  Its use does not increase security; rather, it
+   # minimizes the probability of failure in a very cluttered /tmp directory.
+   tmp=$TMPDIR/foo$$-$RANDOM
+   (umask 077 && mkdir "$tmp")
+ @} ||
+ @{
+   echo "$0: cannot create a temporary directory in $TMPDIR" >&2
+   @{ (exit 1); exit 1; @}
+ @}
+ @end example
+ 
+ 
  @item @command{mv}
  @c ---------------
  @prindex @command{mv}

Bruno





reply via email to

[Prev in Thread] Current Thread [Next in Thread]