Re: Security Anti Symlink Attack Patch for 2.1.71

[Christoph Lameter]

Ok. Then I need to add condition 3 (which is already dealt with in the old
patch)

3. Symlinks established by other user except root in +t dirs are not
followed.

Hmm. This again gets much too complicated..... Anyone got better thoughts?

Maybe better stick with the posted patch?

On Mon, 8 Dec 1997, Erik Corry wrote:

> 
> In article <[e-mail]> you wrote:
> > 1. They cannot be absolute (i.e. they cannot begin with /)
> 
> > 2. They are not allowed to point to a higher directory
> >    (Maybe forbid ".." in symlinks?)
> 
> > Are there any reasons this would not work?
> 
> cd /tmp
> mkdir myowndir
> ln -s anything myowndir/anything
> 
> Now where do you want myowndir/anything to point to?