<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_REOPENED " title="REOPENED - lacks handling of (not-so-)special cases in pa_make_secure_dir()" href="https://bugs.freedesktop.org/show_bug.cgi?id=45656#c15">Comment # 15</a> on <a class="bz_bug_link bz_status_REOPENED " title="REOPENED - lacks handling of (not-so-)special cases in pa_make_secure_dir()" href="https://bugs.freedesktop.org/show_bug.cgi?id=45656">bug 45656</a> from <a class="email" href="mailto:tanuk@iki.fi" title="Tanu Kaskinen <tanuk@iki.fi>"> Tanu Kaskinen</a> <pre>I re-read the discussion in this bug, and Marc's patch in <a href="show_bug.cgi?id=45656#c12">comment 12</a> seems like a sensible thing to do (sorry, Marc, for ignoring you for so long). Now, regarding O_NOFOLLOW, I don't quite understand why Lennart was so strongly against symlinks. As far as I can tell, the purpose of O_NOFOLLOW is just to avoid trouble *after* the user has already shot himself in the foot by creating a symlink that others can modify. That's a nice thing to do, but if the extra caution causes trouble, then it's probably not worth it. I don't see any security problems if the symlink is in the user's home directory where others can't write. I'm in favour of removing the O_NOFOLLOW flag. (Maybe it should be removed from pa_lock_file() and pid.c:open_pid_file() too?)</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> <li>You are the QA Contact for the bug.</li> </ul> </body> </html>