[SSSD] [PATCH] Fix TOCTOU race conditions by copying and removing directory trees

Pavel Březina pbrezina at redhat.com
Wed Jan 23 11:41:32 UTC 2013


On 01/23/2013 12:37 PM, Jakub Hrozek wrote:
> [PATCH 1/2] TOOLS: Use openat/unlinkat when removing the homedir
>
> The removal of a home directory is sensitive to concurrent modification
> of the directory tree being removed and can unlink files outside the
> directory tree.
>
> [PATCH 2/2] TOOLS: Use file descriptor to avoid races when creating a
> home directory
>
> When creating a home directory, the destination tree can be modified in
> various ways while it is being constructed because directory permissions
> are set before populating the directory. This can lead to file creation
> and permission changes outside the target directory tree, using hard links.
>
> https://fedorahosted.org/sssd/ticket/1782
>
> This security problem was assigned CVE-2013-0219

Already reviewed during the embargo. Ack.




More information about the sssd-devel mailing list