[SSSD] [PATCH] Fix TOCTOU race conditions by copying and removing directory trees

Jakub Hrozek jhrozek at redhat.com
Tue Jan 29 15:27:01 UTC 2013


On Wed, Jan 23, 2013 at 02:41:50PM +0100, Jakub Hrozek wrote:
> On Wed, Jan 23, 2013 at 12:41:32PM +0100, Pavel Březina wrote:
> > On 01/23/2013 12:37 PM, Jakub Hrozek wrote:
> > >[PATCH 1/2] TOOLS: Use openat/unlinkat when removing the homedir
> > >
> > >The removal of a home directory is sensitive to concurrent modification
> > >of the directory tree being removed and can unlink files outside the
> > >directory tree.
> > >
> > >[PATCH 2/2] TOOLS: Use file descriptor to avoid races when creating a
> > >home directory
> > >
> > >When creating a home directory, the destination tree can be modified in
> > >various ways while it is being constructed because directory permissions
> > >are set before populating the directory. This can lead to file creation
> > >and permission changes outside the target directory tree, using hard links.
> > >
> > >https://fedorahosted.org/sssd/ticket/1782
> > >
> > >This security problem was assigned CVE-2013-0219
> > 
> > Already reviewed during the embargo. Ack.
> 
> Pushed to master and sssd-1-9

Backported and pushed to sssd-1-8



More information about the sssd-devel mailing list