Re: TOCTOU bug in make(1)

[Lloyd Parkes <lloyd%must-have-coffee.gen.nz@localhost>]

On 7/10/22 08:43, Joerg Sonnenberger wrote:
> Am Thu, Oct 06, 2022 at 01:19:24PM -0500 schrieb Mario Campos:
> > I ran CodeQL, a SAST tool, against trunk. It found a TOCTOU vulnerability
> > in the `unlink_file` function of make(1). The function is a small wrapper
> > over unlink(2), but it first checks that the file exists using lstat(2).
> > Although I don't see an immediate danger here, I admit I'm not
> > very imaginative for vulnerabilities.
>
> This is necessary for historic reasons because old UNIX systems allows
> unlink(2) on directories with bad consequences.

That's a good point. Personally, I had forgotten that unlinking 
directories was a thing. We should put a comment in the code for 
unlink_file() about that.

Cheers,
Lloyd