Re: [dev] [sbase] cp and security

Hey,

On 23 June 2011 22:59, Random832 <random832_AT_fastmail.us> wrote:
> Emulate fchdir with a "magic cookie" struct containing an absolute path,
> device, and inode number [stat(".") every time and panic if device and
> inode number don't match the cookie]

Do you think we could rely on just the physical path, in order to
ensure the (physical) path of the chdir'd directory 'z' in the
(physical) path '/x/y' must be '/x/y/z', and if it isn't someone's
tried to send us through a symlink. I don't think it would matter in
such a case that we must check the device or inode, so long as the
directory is empty.

Thanks,
cls
Received on Fri Jun 24 2011 - 09:53:09 CEST