X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=util-vserver%2Flib_internal%2Funify-unify.c;h=a3d6a18ab0baa8f3073c6b8b0cc959e56838848d;hb=37705d50d8885d4ec983fc0b373704ab42d95eaf;hp=7270532f09b04dc25576d34e5b7a46ec6021f2c9;hpb=faab6e9999beadf6721b553d6457b060549ab434;p=util-vserver.git diff --git a/util-vserver/lib_internal/unify-unify.c b/util-vserver/lib_internal/unify-unify.c index 7270532..a3d6a18 100644 --- a/util-vserver/lib_internal/unify-unify.c +++ b/util-vserver/lib_internal/unify-unify.c @@ -57,6 +57,10 @@ Unify_unify(char const *src, struct stat const UNUSED *src_stat, } // and rename the old file to this name + + // NOTE: this rename() is race-free; when an attacker makes 'tmpfile' a + // directory, the operation would fail; when making it a symlink to a file + // or directory, the symlink but not the file/directory would be overridden if (rename(dst, tmpfile)==-1) { perror("rename()"); goto err;