On Mon, 2005-12-19 at 09:14 +0100, Henrik Stoerner wrote:

On Mon, Dec 19, 2005 at 03:33:38PM +1100, Adam Goryachev wrote:

...

Just thought I might clarify tmp file handling for hobbit and hobbit client specifically.

It would seem to me that tmp file handling is probably insecure... -rw-r--r-- 1 hobbit hobbit 237 2005-12-19 14:41 hobbit_vmstat.12913 -rw-r--r-- 1 hobbit hobbit 14996 2005-12-19 14:41 msg.txt

ie, it is easy for an 'attacker' to create a file called msg.txt before hobbit does (though it seems that file is kept there all the time, so it would have to be created between system bootup and hobbit startup.

Hobbit does create a tmp directory for itself. Unless you've changed the configuration, all temporary files are kept in the directory pointed to by the BBTMP setting in hobbitclient.cfg; by default that is ~hobbit/client/tmp/

Well, I simply installed the 1.2p1 version from the deb file on sourceforge... I didn't customise/change anything at all. Perhaps this is different in the deb package version ??

You're right that the statically named "msg.txt" file could be a problem. In the current snapshot I've changed the client script to always generate the message using a temporary filename ("msg.txt.$$" which uses the PID of the client process - it changes from time to time). The hobbitclient.sh script now does

TEMPFILE="$BBTMP/msg.txt.$$"
rm -f $TEMPFILE
touch $TEMPFILE
... more commands to build and send the client message ...
rm -f $BBTMP/msg.txt
mv $TEMPFILE $BBTMP/msg.txt

If using a private tmp directory, then I don't really see this as a problem.. however, how about something like:

if [ -x /bin/mktemp ] then MKTEMP=/bin/mktemp else if [ -s /usr/bin/mktemp ] then MKTEMP=/usr/bin/mktemp fi if [ ! -z MKTEMP ] then TEMPFILE=$MKTEMP $BBTMP/msg.txt.XXXXXXX else TEMPFILE="$BBTMP/msg.txt.$$" rm -f $TEMPFILE touch $TEMPFILE etc.... fi

that way on hosts that have a mktemp in some 'standard' location, then it will default to being 'more' secure....

The reason why I save the latest message in msg.txt is for debugging only. The ideal thing would be to use the "mktemp" command, but that is not available on all systems where the client may run.

This has been in the snapshots since November.

I suppose also, a simple if [ -e $TEMPFILE ] could check to see if the file exists, and then just immediately send some red alert to hobbit server with a reason.... "Possible symlink attack, file xyz already exists" etc....

Anyway, for me, it isn't a big concern, just noticed it, and thought I'd ask about it....

Regards, Adam