[14806] in bugtraq
Race condition in "rm -r"
daemon@ATHENA.MIT.EDU (Morten Welinder)
Sat May 6 16:08:51 2000
Message-Id: <200005031413.QAA03124@tyr.diku.dk>
Date: Wed, 3 May 2000 16:13:23 +0200
Reply-To: Morten Welinder <terra@DIKU.DK>
From: Morten Welinder <terra@DIKU.DK>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
Synopsis:
If root ever does "rm -rf /tmp/foo" for a directory structure
not completely owned by root, a local user can delete all files
that root can.
Such deletions are common for (a) /tmp cleanup and (b) before
creating a specific directory in /tmp/.
Details:
"rm -r" implementations (Solaris 7, Gnu 4.0 checked) walk the
directories, lstats files, and chdirs into directories (and
recurs). Oh, and deletes stuff, of course.
It is possible to replace a directory by a symlink, say "/",
and have rm cheerfully follow it.
The race window is small -- it will take thousands upon thousands
of tries. Moreover, since the racing involves rmdir -- which
typically is not very fast -- you'll need patience and "nice"
and any other help you can get.
Solutions:
Maybe stat "." after chdir to verify that we ended up the
expected place?
Also affected:
chmod, chown, chgrp. (Probably; this is guesswork.)
