<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<blockquote cite="mid:1240409950.3479.23.camel@hopeson" type="cite">
<blockquote type="cite">
<pre wrap="">
Warning: Using access() to check if a user is authorized to, for
example, open a file before actually doing so using open(2) creates a
security hole, because the user might exploit the short time
interval between checking and opening the file to manipulate it. For
this reason, the use of this system call should be avoided.
</pre>
</blockquote>
<pre wrap=""><!----></pre>
</blockquote>
<br>
Out of curiosity and for my own edification what is the exploit and why
use access() at all? If access() returns denied the file won't attempt
to be opened, how is this different than calling open() and getting an
EPERM? If access() returns success then you attempt to open the file
which either succeeds or fails, presumably based on the same permission
check access() just performed. Trying to exploit the interval of time
between the two system calls seems extraordinarily difficult. If the
user has permission to change the protection on the file then why is
the interval of time between access() and open() meaningful, they have
the capacity to manipulate the file. Finally, why use access() at all,
why not just try open() and check for EPERM?<br>
<pre class="moz-signature" cols="72">--
John Dennis <a class="moz-txt-link-rfc2396E" href="mailto:jdennis@redhat.com"><jdennis@redhat.com></a>
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>