Re: SECURITY: psql allows symlink games in /tmp

Поиск
Список
Период
Сортировка
От Bruce Momjian
Тема Re: SECURITY: psql allows symlink games in /tmp
Дата
Msg-id 200011251428.JAA09526@candle.pha.pa.us
обсуждение исходный текст
Ответ на SECURITY: psql allows symlink games in /tmp  (Andrew Bartlett <abartlet@pcug.org.au>)
Список pgsql-hackers
> Looks like what I would have done if I knew C.
> 
> The only issue remaining is a policy issue as to if psql should call an
> editor in /tmp at all, considering the issues raised bye the recent joe
> vulnerability, ie can we trust the editor not to do a crazy thing, like
> not creating a similarly predictable backup-file name etc.  It should at
> least be documented so that a more parinoid sys-admin can make sure that
> users use a private TMPDIR.

Not sure it is worth the addition.

--  Bruce Momjian                        |  http://candle.pha.pa.us pgman@candle.pha.pa.us               |  (610)
853-3000+  If your life is a hard drive,     |  830 Blythe Avenue +  Christ can be your backup.        |  Drexel Hill,
Pennsylvania19026
 


В списке pgsql-hackers по дате отправления:

Предыдущее
От: Peter Eisentraut
Дата:
Сообщение: Re: location of Unix socket
Следующее
От: Peter Eisentraut
Дата:
Сообщение: Re: OK, that's one LOCALE bug report too many...