[SSSD] [PATCH] Fix TOCTOU race conditions by copying and removing directory trees

Jakub Hrozek jhrozek at redhat.com
Wed Jan 23 13:41:50 UTC 2013


On Wed, Jan 23, 2013 at 12:41:32PM +0100, Pavel Březina wrote:
> On 01/23/2013 12:37 PM, Jakub Hrozek wrote:
> >[PATCH 1/2] TOOLS: Use openat/unlinkat when removing the homedir
> >
> >The removal of a home directory is sensitive to concurrent modification
> >of the directory tree being removed and can unlink files outside the
> >directory tree.
> >
> >[PATCH 2/2] TOOLS: Use file descriptor to avoid races when creating a
> >home directory
> >
> >When creating a home directory, the destination tree can be modified in
> >various ways while it is being constructed because directory permissions
> >are set before populating the directory. This can lead to file creation
> >and permission changes outside the target directory tree, using hard links.
> >
> >https://fedorahosted.org/sssd/ticket/1782
> >
> >This security problem was assigned CVE-2013-0219
> 
> Already reviewed during the embargo. Ack.

Pushed to master and sssd-1-9



More information about the sssd-devel mailing list