Michael Orlitzky <m...@gentoo.org> wrote: > On 12/6/20 11:57 AM, Martin Vaeth wrote: >> Michael Orlitzky <m...@gentoo.org> wrote: >>> >>> Why are you focusing on /tmp and /var/tmp? >> Because only world-writable directories are the ones which >> can be exploited unless the tmpfiles.conf author does >> something malevolent or extremely stupid. > > This is completely untrue
You are right: It is untrue that even /tmp and /var/tmp are under danger if the *.conf files are neiter malevolent nor stupid. On my system there is no such file, and I have quite some packages installed. I doubt that any gentoo package contains such a *.conf file which could trigger a problem even on /tmp or /var/tmp, even if that should not have been deleted on boot. > but I'm not about to get into an argument over something > that you can easily check yourself. Caveat emptor. Such a statement without a proof is called FUD. If you find a *.conf file in some package or ebuild which constitutes a problem for proper usage of opentmpfiles, you should post it.
