Re: Idea: flink() and anon_open()

Zack Weinberg (zack@rabi.phys.columbia.edu)
Sun, 08 Mar 1998 10:44:45 -0500


On Sun, 8 Mar 1998 13:20:37 +0100, Pavel Machek wrote:
>Hi!
>
>> I'd like to suggest two new system calls. They are logical extensions
>> of the existing filesystem features, and they make it possible to do
>> all sorts of interesting things. I particularly want them because I'm
>> writing a program that will be used to install system-critical files
>> (libc), and there are some race conditions that they would
>> eliminate.
>
>Hmm. I believe they are not needed. Just create directory /safetmp,
>with perms 700 owned by root and play with it. This way, noone can
>explore races.

To get equivalent functionality, you'd need safetmp directories in
every file system. That would require my installation program to know
about which parts of the file tree are on which partitions, which is
unnecessary complexity IMO. Further, the program cannot count on
safetmp existing, so it would have to create one, and there are races again.

You would also need separate directories for every user. Most /tmp
races are an issue even if the program attacked is not privileged.
Using $HOME is not always the Right Thing; for instance, if $HOME is
NFS mounted, and /tmp isn't, your compile will run two or three times
slower if temporary files have to go in $HOME.

zw

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu