Re: security: version update: version 0.1.14 beta-15 (was: Insecure lockfile creation - vulnerability report)

[Robert Felber]

On Thu, Mar 27, 2008 at 11:52:17PM +0100, Andrej Kacian wrote:
> On Tue, 25 Mar 2008 01:40:31 +0100
> Robert Felber <[EMAIL PROTECTED]> wrote:
> 
> > the new version addresses the issue below. Policyd-weight does now exit if 
> > it
> > detects symlinks on directories or sockets at startup or directory creation.
> 
> Hello Robert,
> 
> I'm afraid 0.1.14.15 doesn't fix the issue reported.
> 
> By symlinking /tmp/.policyd-weight to /root and starting policyd-weight, I was
> still able to change ownership of /root directory to user policyd-weight is
> configured to run as.

Thanks for reporting.

This is weird, and I am a little bit confused:

# perl -wle 'if(-l "/tmp/.policyd-weight"){ print "err" }'
err

The question is now, why the same test in policyd-weight is
not resulting in a true value.



-- 
    Robert Felber (PGP: 896CF30B)
    Munich, Germany

____________________________________________________________
Policyd-weight Mailinglist - http://www.policyd-weight.org/