On Fri, Jul 18, 2008 at 3:45 PM, Ben Schmidt <[EMAIL PROTECTED]> wrote: > > Jan Minář wrote: >> mktemp(1) creates the file securely, with 0600 permissions. That's the >> whole point. There is no race condition. That's the whole point. > > Presuming the directory it's in is sticky or such so other users can't > change it. I suppose it probably is on most systems, but I doubt it is > on all... :-\
Interesting! I never would have thought security of code running on a million platforms is going to be so much pain^H^H^H^Hfun! If creating a temporary file securely is possible at all, shouldn't mktemp(1) do just that? And if it doesn't, is Vim source code the right place to fix it? The configure can just use a fixed file name in the current directory. Anyway, I have adapted some code from src/auto/configure that will work on systems without mktemp(1) -- patch attached. Cheers, Jan. --~--~---------~--~----~------------~-------~--~----~ You received this message from the "vim_dev" maillist. For more information, visit http://www.vim.org/maillist.php -~----------~----~----~----~------~----~------~--~---
configure.in-advisory.patch-002
Description: Binary data
