Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #229490

Re: Where to report: root fails to edit other users file in sticky bit directory

Show all headers | View raw

On Tue, Dec 08, 2020 at 09:50:32PM +0100, MichaIng wrote:
> And, root should IMO still be allowed to do it, as practically it can anyway
> via chown. root can as well remove any file, regardless of sticky bit, so
> this would be consistent.

Unexpected clobberin' by root is the actual *worst* case that this
security feature is trying to protect against.  Imagine this hypothetical
scenario:

1) Process A running as regular user alice creates a temp file in /tmp,
   owned by alice.

2) Dumb process B running as root decides to use the exact same temp file
   name that A is using.  It opens the file naively, and writes some
   stuff to it, intending to read it back later.

3) Process A rewinds the file and writes new stuff to it.

4) Process B reads process A's data from the file, thinking it was going
   to read its own data.

5) Process B calculates the wrong thing, and turns off the life support
   system.

I don't know how realistic this is, or how closely it mirrors the thought
processes of the people who came up with the modification.  But if you're
going to make this modification at all, it needs to affect root, or else
it's pointless.

Your unique situation, where user A is putting a file in /tmp for some
reason, and then user R is supposed to edit it in place, is really weird.
I don't know why you're putting this important shared file in /tmp, but
you might want to move it to a more appropriate place.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Where to report: root fails to edit other users file in sticky bit  directory MichaIng <micha@dietpi.com> - 2020-12-04 15:00 +0100
  Re: Where to report: root fails to edit other users file in sticky  bit directory <tomas@tuxteam.de> - 2020-12-04 15:20 +0100
  Re: Where to report: root fails to edit other users file in sticky  bit directory Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-04 16:10 +0100
  Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-08 16:00 +0100
    Re: Where to report: root fails to edit other users file in sticky  bit directory Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-08 16:20 +0100
      Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-08 16:50 +0100
        Re: Where to report: root fails to edit other users file in sticky  bit directory Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 10:30 +0100
    Re: Where to report: root fails to edit other users file in sticky  bit directory <tomas@tuxteam.de> - 2020-12-08 17:00 +0100
      Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-08 17:10 +0100
        Re: Where to report: root fails to edit other users file in sticky  bit directory <tomas@tuxteam.de> - 2020-12-08 17:50 +0100
          Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-08 18:10 +0100
            Re: Where to report: root fails to edit other users file in sticky  bit directory <tomas@tuxteam.de> - 2020-12-08 18:50 +0100
              Re: Where to report: root fails to edit other users file in sticky  bit directory Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-08 19:30 +0100
                Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-08 22:00 +0100
                Re: Where to report: root fails to edit other users file in sticky  bit directory Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-08 22:10 +0100
                Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-09 00:10 +0100
                Re: Where to report: root fails to edit other users file in sticky  bit directory Greg Wooledge <wooledg@eeg.ccf.org> - 2020-12-09 04:00 +0100
                Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-09 17:40 +0100
    Re: Where to report: root fails to edit other users file in sticky  bit directory Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 10:40 +0100
      Re: Where to report: root fails to edit other users file in sticky  bit directory MichaIng <micha@dietpi.com> - 2020-12-09 16:50 +0100
        Re: Where to report: root fails to edit other users file in sticky  bit directory Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 16:50 +0100

csiph-web