[devel] suid/sgid programs and temporary files

[Alexey Tourbin <at@altlinux.ru>]

[-- Attachment #1: Type: text/plain, Size: 1627 bytes --]

В /usr/lib/perl5/File/Temp.pm есть функция проверки временного каталога,
в котором будут созданы временные файлы.

   649  # internal routine to check to see if the directory is safe
   650  # First checks to see if the directory is not owned by the
   651  # current user or root. Then checks to see if anyone else
   652  # can write to the directory and if so, checks to see if
   653  # it has the sticky bit set
...
   668  sub _is_safe {
   669
   670    my $path = shift;
   671    my $err_ref = shift;
   672
   673    # Stat path
   674    my @info = stat($path);
   675    unless (scalar(@info)) {
   676      $$err_ref = "stat(path) returned no values";
   677      return 0;
   678    };
   679    return 1 if $^O eq 'VMS';  # owner delete control at file level
   680
   681    # Check to see whether owner is neither superuser (or a system uid) nor me
   682    # Use the real uid from the $< variable
   683    # UID is in [4]
   684    if ($info[4] > File::Temp->top_system_uid() && $info[4] != $<) {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   685
   686      Carp::cluck(sprintf "uid=$info[4] topuid=%s \$<=$< path='$path'",
   687                  File::Temp->top_system_uid());
   688
   689      $$err_ref = "Directory owned neither by root nor the current user"
   690        if ref($err_ref);
   691      return 0;
   692    }
...

Условия подчеркнутой проверки можно перевести примерно как
	st.st_uid > 10 && st.st_uid != getuid()

Вопрос: хорошо ли, что здесь используется real uid?  Не лучше ли
проверять effective uid? 

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]