On Thu, 29 Mar 2001, Philip Hazel wrote:
> standard, whereas mkstemp() is not. Can you guarantee that mkstemp() is
> available in every version of Unix that Exim supports? The RedHat Linux
no, thats why i added a `where possible' clause.
openbsd 2.6 says (sorry for posting this long, just the relevant
pieces):
STANDARDS
The tmpfile() and tmpnam() functions conform to ANSI X3.159-1989
(``ANSI C'')
BUGS
tmpnam() and tempnam() are provided for System V and ANSI
compatibility only. These interfaces are typically not used
in safe ways. The mkxx- stemp(3) interface is strongly preferred.
There are four important problems with these interfaces (as well
as with the historic mktemp(3) interface). First, there is an
obvious race be- tween file name selection and file creation and
deletion: the program is typically written to call tmpnam(),
tmpname(), or mktemp(3). Subsequent- ly, the program calls
open(2) or fopen(3) and erroneously opens a file
(or symbolic link, or fifo or other device) that the attacker has
placed in the expected file location. Hence mkstemp(3) is
recommended, since it atomically creates the file.
Second, most historic implementations provide only a limited
number of possible temporary file names (usually 26) before file
names will start being recycled. Third, the System V
implementations of these functions
(and of mktemp) use the access(2) function to determine whether
or not the temporary file may be created. This has obvious
ramifications for daemons or setuid/setgid programs, complicating
the portable use of these
interfaces in such programs. Finally, there is no specification
of the permissions with which the temporary files are created.
and yes, it states that:
This implementation does not have these flaws, but portable
software cannot depend on that.
--
[-]
<Andras> sawfish, icewm theme-mel, vagy icewm, sawfish theme-mel?
