Re: [PATCH] Use an unique temporary multistrap file and remove it afterwards

Yann Dirson <[email protected]>
Newsgroups gmane.linux.debian.devel.embedded
Message-ID <[email protected]>
> With adding the Process ID to the temporary multistrap configuration file
> makes it unique. This allows multiple invocations on the same time.
> For multi user system as Linux is, is this important.
> 
> Also is the temp file deleted after usage.

While it is better than the original, it still allows for attacks -
using a predictable filename in /tmp is always a security issue, and
even the PID does make it imune to attacks (google for "tmp symlink
attack" for details).

Please consider using tempfile(1) for safely getting a temporary file.

Best regards,
-- 
Yann
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.