Subject: Re: security/7060: find and rm
To: None <richard.earnshaw@arm.com>
From: Chris Jones <cjones@rupert.honors.montana.edu>
List: netbsd-bugs
Date: 03/01/1999 09:21:25
>>>>> "Richard" == Richard Earnshaw <rearnsha@arm.com> writes:

Richard> Hm, why not add a -rm option to find.  Then there can be no
Richard> race, since we can bypass the inode->filename->inode
Richard> translation (which is the root cause of the hole).

No, the race condition is still there; the window is just much
smaller.  The getdents() call will return a filename, which you then
stat().  But then you have to use the filename again when you
unlink().  The problem with filenames is that they're sort of
ephemeral; they're not guaranteed to not point to a different file
from the last time you used them.

Chris

-- 
-----------------------------------------------------cjones@math.montana.edu
Chris Jones                                          cjones@honors.montana.edu
           Mad scientist at large                    cjones@nervana.montana.edu
"Is this going to be a stand-up programming session, sir, or another bug hunt?"