[Libreoffice] [PATCH] Simplify a function returning the temporary directory name
Tor Lillqvist
tlillqvist at novell.com
Fri Jul 15 00:14:14 PDT 2011
> Would that be more acceptable ?
Well, I am not saying they are unacceptable.
I just wanted a bit of discussion with perhaps somebody actually clueful about security issues giving their opinion;)
Quite possibly the checks make good sense, and are not a risk as nobody is going to run LibreOffice setuid anyway, which, if I understand correctly, is the main situation where TOCTTOU, especially with access() as the "check" phase, is a vulnerability? Is it the only situation?
--tml
More information about the LibreOffice
mailing list