Re: [Lcd4linux-devel] make lcd4linux secure!

[Xavier V. <xav...@fr...>]

Hello Michael !

[snip]

> 1. the temp file is opened with O_CREAT. If a symlink is already 
> present, it's target will be overwritten. Some security HOWTO's say one 
> should use O_CREAT|O_EXCL, which means that the call will fail if the 
> file already exists. OTOH, the open(2) man page states that thios 
> doesn't work over NFS :-(
> 2. the rename() will overwrite a symlink, too.

Maybe you should do it like I did in plugin_i2c_sensors to check we have
a directory :
it did "if ((dir->d_type!=DT_DIR && dir->d_type!=DT_LNK)" to check if
it's a dir or a symlink. You should check if it isN'T a symlink but a
true file. I don't know how to get this d_type for a special file, I did
it with readdir.

Bye !
-- 
Xavier VELLO <xav...@fr...>