[pulseaudio-tickets] [Bug 45656] lacks handling of (not-so-)special cases in pa_make_secure_dir()

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=45656

--- Comment #15 from Tanu Kaskinen <tanuk at iki.fi> ---
I re-read the discussion in this bug, and Marc's patch in comment 12 seems like
a sensible thing to do (sorry, Marc, for ignoring you for so long).

Now, regarding O_NOFOLLOW, I don't quite understand why Lennart was so strongly
against symlinks. As far as I can tell, the purpose of O_NOFOLLOW is just to
avoid trouble *after* the user has already shot himself in the foot by creating
a symlink that others can modify. That's a nice thing to do, but if the extra
caution causes trouble, then it's probably not worth it. I don't see any
security problems if the symlink is in the user's home directory where others
can't write. I'm in favour of removing the O_NOFOLLOW flag. (Maybe it should be
removed from pa_lock_file() and pid.c:open_pid_file() too?)

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/pulseaudio-bugs/attachments/20170608/fab8fa3b/attachment.html>