Re: TOCTOU symlink race bypasses --operatingdir confinement

Benno Schulenberg <[email protected]> Tue, 28 Apr 2026 16:44:23 +0200

Newsgroups	gmane.editors.nano.devel
Message-ID	<[email protected]>

Op 28-04-2026 om 04:12 schreef zero_o:
>    I discovered a TOCTOU symlink race in nano 9.0 that bypasses the
>    --operatingdir sandbox, allowing arbitrary file reads and writes
>    outside the confined directory.

Thanks for the report and for the suggested fix.  However... what
exactly is the threat model?  If a user employs --operatingdir to
confine themselves to a directory that is also writable by others,
then they are being foolish.  If they want to confine themselves,
they should at least do that to a place where only they have access.
And if they get confined to a public place by some script employing
--operatingdir, then the same thing: the script is foolish.  But
even _when_ confined to a public place, what harm is there when the
user gets redirected to /etc/passwd or /etc/shadow?  They cannot
write those files, and cannot even read the latter.  Redirecting
the user in this way is only a nuisance, not a security threat.

>    I'm attaching a detailed report
>    and a proof-of-concept exploit.

What's the exploit there?  Which file gets unintentionally overwritten?
If you want to claim an exploit, you must show that even when the user
confines themselves to a private place, that they can somehow be made
to unintentionally overwrite a file _different_ from the one intended
(and possibly outside of the confinement).

So, until then, I would say that the security impact of this issue is
zero, and the possible nuisance impact very low.


(At the moment I'm still busy with the man-page patches, and only
halfway through.  When I'm done with those, I'll have a look at
this and see whether to make the suggested change anyway.)


Benno

OpenPGP_signature.asc (application/pgp-signature, 840 B)