Re: Insecure use of file in /tmp by trn

[R.E.Wolff () BITWIZARD NL (Rogier Wolff)]

Ben Pfaff wrote:
> Rogier Wolff <R.E.Wolff () BITWIZARD NL> writes:
> > Creating a tempfile from a C program is possible since we have a
[...]
> SYNOPSIS
>      mktemp [-q] [-u] template
>
> DESCRIPTION
[...]
>      If mktemp can successfully generate a unique file name, the file is cre-
>      ated with mode 0600 (unless the -u flag is given) and the filename is
>      printed to standard output.

Last I looked at the "mktemp" manpage it didn't create the file, and
was thus vulnerable to races. This is an incompatible change that
others didn't dare make.

The world is becoming a better place ;-)

                Roger.

--
** R.E.Wolff () BitWizard nl ** http://www.BitWizard.nl/ ** +31-15-2137555 **
*-- BitWizard writes Linux device drivers for any device you may have! --*
------ Microsoft SELLS you Windows, Linux GIVES you the whole house ------