Bruce Guenter <[EMAIL PROTECTED]> wrote:
> On Wed, Mar 28, 2001 at 02:04:13PM -0600, Charles Cazabon wrote:
> > By the time we have to worry about wrapping 16-bit PIDs in one second,
> > we'll be using 32-bit PIDs. No worries.
>
> Um, too late. I believe Dave Miller's group was wrapping the PID
> counter in under a second on a Sparc a couple of years ago already.
But they were doing fork(); exit() (or the equivalent of) if I remember
correctly. With real processes, especially doing Maildir deliveries (with the
accompanying I/O delays), I'm not particularly worried. Sure, an attacker
could spawn a lot of short-lived processes in an attempt to cause a
collision in mail delivery, but they'd need local access to the box to even
have a shot at it.
Besides, getmail uses's djb's pid_deliverycount for the middle member of
the filename, since it does multiple deliveries from the same process.
The attacker can't cause a collision here even that easily.
Charles
--
-----------------------------------------------------------------------
Charles Cazabon <[EMAIL PROTECTED]>
GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/
Any opinions expressed are just that -- my opinions.
-----------------------------------------------------------------------
