Re: ztempfile

On Fri, Aug 15, 2003 at 01:47:23PM +0400, Igor V. Melichev wrote:
> 1. If the argument starts with root, the permissions are checked fine.
> 2. If the argument starts with cwd or parent, the permissions are checked
> fine;

If we are to allow this case, then we must patch gp_open_scratch_file
so that it does not prepend "/tmp" (or whatever the tmpfile directory
is). In my opinion, it's simpler to disallow it.

> 3. If the argument does not start with root, cwd or parent,
>     it is prepended with a result of gp_gettmpdir,
>     and then the permissions are checked fine.

I think we disagree most strongly on this case. In the common case,
the path returned by gp_gettmpdir will _not_ be present on the
PermitFileWriting list. This is as it should be; in the usual case, it
is fine to create temp files in the temp dir (with unique names that
do not conflict with existing files), but not to read and write
arbitrary files there.

> 4. The branch strcpy(tdir, gp_file_name_current());
>     never executes;
> 5. There is an unobvious case, when gp_gettmpdir
>     returns a path, which does not start with root, cwd or parent.
>     The regular check for permissions is applied to it.
>     It succeeds Iff the list permits it.
>     Thus it is under user's control, and I conclude it is fine.
> 
> I don't see more cases. Do you ?

I think the other interesting case is a prefix like "a/b". It is
most secure to disallow it, otherwise users will be able to write
junk into directories that normally would be considered private to
other applications. Logic to disallow this case, but allow the others
you list above, would be rather complicated. I much prefer the simpler
approach of disallowing all prefixes other than "simple" and absolute.

Raph