From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753233AbdLAPxY (ORCPT ); Fri, 1 Dec 2017 10:53:24 -0500 Received: from www.llwyncelyn.cymru ([82.70.14.225]:52530 "EHLO fuzix.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753165AbdLAPxW (ORCPT ); Fri, 1 Dec 2017 10:53:22 -0500 Date: Fri, 1 Dec 2017 15:52:57 +0000 From: Alan Cox To: David Laight Cc: "'Solar Designer'" , "'Salvatore Mesoraca'" , "linux-kernel@vger.kernel.org" , "Kernel Hardening" , "linux-fsdevel@vger.kernel.org" , "Alexander Viro" , Jann Horn , Kees Cook , "Eric W. Biederman" Subject: Re: [PATCH v3 2/2] Protected O_CREAT open in sticky directories Message-ID: <20171201155257.561b2c27@alans-desktop> In-Reply-To: References: <1511337706-8297-1-git-send-email-s.mesoraca16@gmail.com> <1511337706-8297-3-git-send-email-s.mesoraca16@gmail.com> <9fe9b2cd312748ddb31f63f9dc1b1ed8@AcuMS.aculab.com> <20171130175147.GA4124@openwall.com> Organization: Intel Corporation X-Mailer: Claws Mail 3.15.1-dirty (GTK+ 2.24.31; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > > That's general misuse of /tmp. Things like "command > /tmp/file" > > without having pre-created the file with O_EXCL e.g. by mktemp(1). > > I'm sorry, I've been using Unix for over 30 years. > /tmp is a place that temporary files were created - nothing special. > Traditionally it was emptied on every boot. > There was never anything that required files be created in any > specific way. And in 1978 you had to boot single user and use nckeck and icheck to fix the filesystem up by hand, you had no networking, no systemd, no sysvinit, no ANSI C. no X11 ... (shall I go on...) There are reasons it all changed. The origin of /tmp is a compromise of security and disk performance made in the 1970s about an OS that was quite different, running on a machine with typically 256K of RAM, no RAM disks, a single very expensive fixed head drive and a larger moving head one. The existence of /tmp in that form today is a bizarre historic quirk. Fortunately if you want a perfectly safe /tmp/ use namespaces and every user can have their own private /tmp. Alan From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Fri, 1 Dec 2017 15:52:57 +0000 From: Alan Cox Message-ID: <20171201155257.561b2c27@alans-desktop> In-Reply-To: References: <1511337706-8297-1-git-send-email-s.mesoraca16@gmail.com> <1511337706-8297-3-git-send-email-s.mesoraca16@gmail.com> <9fe9b2cd312748ddb31f63f9dc1b1ed8@AcuMS.aculab.com> <20171130175147.GA4124@openwall.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: [kernel-hardening] Re: [PATCH v3 2/2] Protected O_CREAT open in sticky directories To: David Laight Cc: 'Solar Designer' , 'Salvatore Mesoraca' , "linux-kernel@vger.kernel.org" , Kernel Hardening , "linux-fsdevel@vger.kernel.org" , Alexander Viro , Jann Horn , Kees Cook , "Eric W. Biederman" List-ID: > > That's general misuse of /tmp. Things like "command > /tmp/file" > > without having pre-created the file with O_EXCL e.g. by mktemp(1). > > I'm sorry, I've been using Unix for over 30 years. > /tmp is a place that temporary files were created - nothing special. > Traditionally it was emptied on every boot. > There was never anything that required files be created in any > specific way. And in 1978 you had to boot single user and use nckeck and icheck to fix the filesystem up by hand, you had no networking, no systemd, no sysvinit, no ANSI C. no X11 ... (shall I go on...) There are reasons it all changed. The origin of /tmp is a compromise of security and disk performance made in the 1970s about an OS that was quite different, running on a machine with typically 256K of RAM, no RAM disks, a single very expensive fixed head drive and a larger moving head one. The existence of /tmp in that form today is a bizarre historic quirk. Fortunately if you want a perfectly safe /tmp/ use namespaces and every user can have their own private /tmp. Alan