Path: csiph.com!goblin2!goblin1!goblin.stu.neva.ru!usenet.stanford.edu!not-for-mail
From: Greg Wooledge <wooledg@eeg.ccf.org>
Newsgroups: gnu.bash.bug
Subject: Re: How do we intercept file saving or output to stdout directly
Date: Thu, 27 Aug 2020 07:24:34 -0400
Lines: 12
Approved: bug-bash@gnu.org
Message-ID: <mailman.1466.1598527478.2469.bug-bash@gnu.org>
References: <20200826121352.GN931@eeg.ccf.org> <1598249852364-0.post@n7.nabble.com> <87a6yinjhl.fsf@hobgoblin.ariadne.com> <6237.1598480806@jinx.noi.kre.to> <20200827112434.GT931@eeg.ccf.org>
NNTP-Posting-Host: lists.gnu.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: usenet.stanford.edu 1598527479 5343 209.51.188.17 (27 Aug 2020 11:24:39 GMT)
X-Complaints-To: action@cs.stanford.edu
To: bug-bash@gnu.org
Envelope-to: bug-bash@gnu.org
Mail-Followup-To: bug-bash@gnu.org
Content-Disposition: inline
In-Reply-To: <6237.1598480806@jinx.noi.kre.to>
User-Agent: Mutt/1.10.1 (2018-07-13)
Received-SPF: none client-ip=139.137.100.1; envelope-from=wooledg@eeg.ccf.org; helo=mail.eeg.ccf.org
X-detected-operating-system: by eggs.gnu.org: First seen = 2020/08/27 07:24:34
X-ACL-Warn: Detected OS   = Linux 2.2.x-3.x [generic] [fuzzy]
X-Spam_score_int: -14
X-Spam_score: -1.5
X-Spam_bar: -
X-Spam_report: (-1.5 / 5.0 requ) BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.4, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=no autolearn_force=no
X-Spam_action: no action
X-BeenThere: bug-bash@gnu.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: Bug reports for the GNU Bourne Again SHell <bug-bash.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=unsubscribe>
List-Archive: <https://lists.gnu.org/archive/html/bug-bash>
List-Post: <mailto:bug-bash@gnu.org>
List-Help: <mailto:bug-bash-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=subscribe>
X-Mailman-Original-Message-ID: <20200827112434.GT931@eeg.ccf.org>
X-Mailman-Original-References: <20200826121352.GN931@eeg.ccf.org> <1598249852364-0.post@n7.nabble.com> <87a6yinjhl.fsf@hobgoblin.ariadne.com> <6237.1598480806@jinx.noi.kre.to>
Xref: csiph.com gnu.bash.bug:16821

On Thu, Aug 27, 2020 at 05:26:46AM +0700, Robert Elz wrote:
>  28469  28469 xkbcomp  CALL  unlink(0x7f7fffffec7b)
>  28469  28469 xkbcomp  NAMI  "/dev/stdout"
>  28469  28469 xkbcomp  RET   unlink -1 errno 13 Permission denied
>  28469  28469 xkbcomp  CALL  open(0x7f7fffffec7b,0xa01,0x1b6)
>  28469  28469 xkbcomp  NAMI  "/dev/stdout"
>  28469  28469 xkbcomp  RET   open -1 errno 17 File exists

Ahh.  Then I revise my guess to "an attempt to prevent someone sneaking
in a symlink between the unlink and the open", i.e. classic race condition
security for publically writable directories like /tmp.