bug#32772: TOCTOU bug in chmod

2018-09-19 Thread Jeff Epler
Thanks for the correction, I should have not suggested a fix off the top of my head. On Wed, Sep 19, 2018 at 2:57 PM Paul Eggert wrote: > Jeff Epler wrote: > > Changing to lchmodat should resolve the problem > > No, that would just introduce the opposite bug: chmod is supposed to > follow a >

bug#32772: TOCTOU bug in chmod

2018-09-19 Thread Paul Eggert
Jeff Epler wrote: Changing to lchmodat should resolve the problem No, that would just introduce the opposite bug: chmod is supposed to follow a symlink, and using lchmod would let an attacker provoke a race that would cause chmod to not follow a symlink that it should. A better way to fix

bug#32774: Filenames with spaces in ls

2018-09-19 Thread Paul Eggert
Ivan Perez wrote: the presence of the extra quote and the misalignment that that causes draws one's attention to the quote. That's part of the intent. The quotes draw the reader's attention to the oddball file name, which is a good thing since these file names can cause trouble when they are

bug#32774: Filenames with spaces in ls

2018-09-19 Thread Ivan Perez
Hi, In a fresh Ubuntu installation, file names with spaces and strange symbols are now quoted. If find this annoying, non-intuitive and, in principle, wrong (I'll explain below). I initially wrote this email a few weeks ago, and decided not to send it without honestly giving it a real

bug#32772: TOCTOU bug in chmod

2018-09-19 Thread Jeff Epler
When a directory is replaced with a symlink at a critical moment, `chmod` will perform the unintended action of changing the mode of the linked-to file or directory. I tested in coreutils 8.26 on debian stretch, but believe that the current version 8.30 and the development version are vulnerable.