linux security - Feb 1999 - When a shell says no (clobber) it means maybe.

As will be seen from these code fragments (and experiment) a noclobber
option in bash or pdksh (or ksh on AIX) will do limited clobbers.

1) They will clobber named pipes.
   (mknod /tmp/predicted p
       cat /tmp/predicted > $stolen
              cat $switched > /tmp/predicted ) &

2) They will clobber symlinks.
   ln -s /some/new/target /tmp/predicted

3) They can be raced.
      mkdir /tmp/predicted
      echo  "hoping stat() happens now:  returns 0 and non S_ISREG"
      mv /tmp/predicted /tmp/other
      ln -s /some/old/target  /tmp/predicted


Is there some reason (such as standards or a situation I've overlooked)
why they should do this and not say noclobber => O_EXCL, end of story ?

exec.c from pdksh-5.2.12


  1293	  case IOWRITE:
  1294		flags = O_WRONLY | O_CREAT | O_TRUNC;
  1295		if (Flag(FNOCLOBBER) && !(iop->flag & IOCLOB)
  1296		    && (stat(cp, &statb) < 0 || S_ISREG(statb.st_mode)))
  1297			flags |= O_EXCL;
  1298		break;


execute_cmd.c from bash-1.14.7

  2834  stat_result = stat (redirectee_word, &finfo);
  2835
  2836  if ((stat_result == 0) && (S_ISREG (finfo.st_mode)))
  2837    {
  2838      free (redirectee_word);
  2839      return (NOCLOBBER_REDIRECT);
  2840    }
  2841
  2842	  /* If the file was not present, make sure we open it exclusively
  2843	     so that if it is created before we open it, our open will fail. */
  2844	  if (stat_result != 0)
  2845	    redirect->flags |= O_EXCL;
  2846
  2847	  fd = open (redirectee_word, redirect->flags, 0666);
  2848
  2849	  if ((fd < 0) && (errno == EEXIST))
  2850	    {
  2851	      free (redirectee_word);
  2852	      return (NOCLOBBER_REDIRECT);
  2853	    }
  2854	}
  2855      else
  2856	{



--
##############################################################
# Antonomasia   ant@notatla.demon.co.uk                      #
# See http://www.notatla.demon.co.uk/                        #
##############################################################

Our nameserver running Redhat Linux 5.2 and the copy and Bind included
therein has recently been subject to attacks from hackers that may have
obtained root access or at least seem to be carrying out attacks on other
hosts imap3d ports from the root user. I had thought all RedHat 5.2 had
the latest version of Bind and wa simmune to that weakness. Anybody got
any ideas or have seen this attack.

Regards, Jeff Koch