[8725] in bugtraq
Re: OSS nice tmp race
daemon@ATHENA.MIT.EDU (Joel Eriksson)
Fri Dec 18 22:05:02 1998
Date: Fri, 18 Dec 1998 22:41:40 +0100
Reply-To: Bugtraq List <BUGTRAQ@NETSPACE.ORG>
From: Joel Eriksson <na98jen@STUDENT.HIG.SE>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <19981217021238.A5786@art.ro>
On Thu, 17 Dec 1998, Stefan Laudat wrote:
> While digging in the "soundon" script delivered with the OSS package (the commercial
> one, of course), I have discovered something very unusual on line 26
>
> $MODTOOLS/insmod -V > /tmp/oss.tmp 2>&1
> # KABOOM! "Hey, Beavis, told ya it was plutonium"
> MODVERS=`head -1 /tmp/oss.tmp|sed 's/.* //'`
> rm -f /tmp/oss.tmp # too late, buddy!
>
>
> Nice,huh? Just imagine that almost all soundcards are PnP today, there are few admins that
> know how to play with isapnp and ALSA (yeah, it rulez), the soundcfg or soundconf (whatever)
> script that comes with RedHat 5.x sucks big time and most of the ppl running LeeNw00x use
> OSS that seems to be a very good tool for the average RewT, honestly. And thank God OSS knows
> lots of soundcards! Most of you are running the soundon script in rc.local, so the
> satisfaction is guaranteed:
>
>
> ln -s /etc/inittab (next boot you're dead)
>
> Don't worry, support@opensound.com has been already notified so they will correct the bug
> ASAP I guess.
> BTW there is no bugs@opensound.com, so I love their optimistic way of thinking.
> I think the correct code is :
>
> ## insert before line 26
> if [ -L /tmp/oss.tmp ]
> then
> logger "Hey,man, you've got a naughty (l)user -- ".`ls -lsa /tmp/oss.tmp`
>
> # die, lam0r! :)
>
> rm /tmp/oss.tmp
> fi
There still exist a race-condition in that code, it just demands better
timing. If the checking for file-existence and the creation of the file
cannot be done atomically, don't do it. In this case there is no need for
a temporary file at all, IMHO a better way to fix the problem is:
MODVERS=$($MODTOOLS/insmod -V 2>/dev/null | head -1 | sed 's/.* //')
I think that would do the trick.
There are of course cases where it's not this easy to get rid of the need
for a temporary file, the best way to fix this problem I think would be if
all users had their own private tmp-directory. I have heard of patches
that makes /tmp to a pseudo-directory that is "private" for each user
that may be useful (I think it was for Linux, but I don't think it is
widely spread).
Since programmers keep repeating the old mistakes over and over again, the
responsibility is ultimately the users. One can't check all of the
sourcecode that we compile (at least not as thouroughly that may be
needed), but eliminating the possibility of certain common bugs from
having any dangerous implications is a first step. I think solutions like
StackGuard and the like is of great use when it comes to this.
> Stefan Laudat
Joel Eriksson
