Re: rm-ing files with open file descriptors

Pavel Machek (pavel@suse.cz)
Wed, 23 Jan 2002 13:18:19 +0100


Hi!

> >> This could be hacked around ofcourse in fs/namei.c, so I tried
> >> it for fun. And indeed, with a minor correction it works:
> >>
> >> % perl flink.pl
> >> Success.
> >>
> >> I now have a flink-test2.txt file. That is pretty cool ;)
> >
> >It's also a security hole.
>
> How is linking back a file into the normal namespace anymore
> a security hole as having it under /proc or keeping an fd to it
> open?

Imagine you want to delete my file, you are root.

Before, you could rm it, then kill all my processes.
Pavel

-- 
(about SSSCA) "I don't say this lightly.  However, I really think that the U.S.
no longer is classifiable as a democracy, but rather as a plutocracy." --hpa
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/