5069084 2000-05-07  02:09  /45 rader/ Postmaster
Mottagare: Bugtraq (import) <10772>
Ärende: Race condition in "rm -r"
------------------------------------------------------------
Approved-By: aleph1@SECURITYFOCUS.COM
Delivered-To: bugtraq@lists.securityfocus.com
Delivered-To: bugtraq@securityfocus.com
Message-ID:  <200005031413.QAA03124@tyr.diku.dk>
Date:         Wed, 3 May 2000 16:13:23 +0200
Reply-To: Morten Welinder <terra@DIKU.DK>
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
From: Morten Welinder <terra@DIKU.DK>
X-To:         bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM

Synopsis:

  If root ever does "rm -rf /tmp/foo" for a directory structure
  not completely owned by root, a local user can delete all files
  that root can.

  Such deletions are common for (a) /tmp cleanup and (b) before
  creating a specific directory in /tmp/.


Details:

  "rm -r" implementations (Solaris 7, Gnu 4.0 checked) walk the
  directories, lstats files, and chdirs into directories (and
  recurs).  Oh, and deletes stuff, of course.

  It is possible to replace a directory by a symlink, say "/",
  and have rm cheerfully follow it.

  The race window is small -- it will take thousands upon thousands
  of tries.  Moreover, since the racing involves rmdir -- which
  typically is not very fast -- you'll need patience and "nice"
  and any other help you can get.


Solutions:

  Maybe stat "." after chdir to verify that we ended up the
  expected place?


Also affected:

  chmod, chown, chgrp.  (Probably; this is guesswork.)
(5069084) ------------------------------------------