top | item 14817355

(no title)

mioelnir | 8 years ago

This of course assumes you are running around an actual multiuser system without 1777 /tmp and 077 umask like it is 1989.

discuss

order

jwilk|8 years ago

All the attacker has to do is:

  touch /tmp/pubkey.pem
  chmod a+w /tmp/pubkey.pem
before the victim runs the code.

No sticky bit, no restrictive umask, also no protected_hardlinks/protected_symlinks is going to save you.