Re: Symlink security...

Felix Schroeter (felix@mamba.pond.sub.org)
25 Jan 1998 23:38:14 +0100


Hello!

James Mastros <root@jennifer-unix.dyn.ml.org> writes:

> [...]
> write -- can change the destination
> [...]

> 1) How is a link written to (in userspace)? (Is there any way to do so, at
> present, without removing the link and recreating it?)

No, there isn't. However, non-atomic writes to symlinks should not be IMHO
and atomic ones can be simulated with standard UN*X system calls
(symlink("/new/dest/inat/ion/path",
"/directory/where/old/symlink/resides/unique_name") -- if that returns
EEXIST, try again with another name.
rename("/directory/where/old/symlink/resides/unique_name",
"/dir.../name_of_old_symlink")
if the latter fails, remove the temporary link and fail).
The only difference is that the "simulation" needs write permission
to the directory (and if the directory is sticky, must be the owner
of the old symlink, the owner of the directory or root).
Call me a paranoid person, but I think that extra restriction is better,
to avoid some symlink attacks that could open up with uncarefully handled
writable symlinks...

> 2) Should I change chmod to not follow links, or should I make a lchown call?

I'm for chown/chmod following symlinks and lchown/lchmod applying to the
symlink itself.

Regards, Felix.