[Nano-devel] [PATCH 2/2] use futimens() if available, instead of utime()

[Kamil Dudka]

Hello,

the attached patch eliminates a race condition on the call of utime()
on systems that have futimens().  In the current code, there is a similar
flaw as described in CVE-2010-1161.  Though it's not possible to change
the ownership of the backup file using a symlink attack, it's still possible 
to change it's atime/mtime.  With the patch applied, there is no such
problem as long as futimens() is available during the build time.

Thanks in advance for considering the patch!

Kamil

0002-use-futimens-if-available-instead-of-utime.patch
Description: Text Data