Well here's a chance for me to learn something... Now that I know my first reply missed the mark completely, I'm curious to find out:

Suppose you do something like this: 

unless ( -l "foo" ) {
    open( FH, ">>foo" ) or die "foo: $!";
}
die "Link attack detected" if ( -l "foo" );

[download]

How does that fail to provide the protection that your script, in its heart of hearts, really wants to provide? I realize that if the symlink gets created during that very brief period of vulnerability, and happens to point to a non-existent file in a valid directory path (with write permission for the effective uid), then a new file will be created according to the name that the abuser has assigned as the symlink's target.

So (sorry, I am honestly naive here) what? Except for that one scenario, it seems to me that no situation arises where any change is made to any file or directory. If the malicious symlink points to an existing data file, the script will die before actually altering that file; if the symlink points to a non-existant directory, the open call itself would fail; creating the symlink too soon will be trapped by the "unless ( -l )", and trying to create too late will fail.

Just in that one specific scenario, a zero-length file could be created, owned by the effective uid of the script -- but nothing will be written to it, the script dies, and whoever was trying the exploit would need a different suid tool to put any data in that file (assuming a proper umask was in place when your script ran).

What am I missing?

In reply to Re: opening files: link checking and race conditions by graff
in thread opening files: link checking and race conditions by danderson

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.