Re: mkstemp

Paul Eggert <[email protected]> 06 Sep 2003 14:44:39 -0700

Newsgroups	gmane.comp.lib.gnulib.bugs,gmane.comp.version-control.cvs.bugs
Message-ID	<[email protected]>

Derek Robert Price <[email protected]> writes:

> Anyhow, is ftruncate, or anything at all, really sufficient to avoid a
> race exploit?

Not that I can see.

> Perhaps it is silly to be working around bugs in glibc this old?  It was
> fixed January 11, 1999.  One could hope that the sysadmin in charge of
> the system on which CVS is being compiled has read the appropriate
> security notices and updated to a more recent version of glibc.

That's what I'd say, too.  The problem affects all sorts of programs,
not just CVS.

> Then again an extra chmod is pretty cheap.

I suspect that the chmod doesn't really fix the race condition.
Setting the umask before, and restoring it after, would probably be a
better fix; but I wouldn't bother.