Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Changes to the filesystem while find is running - comments? |
|---|---|
| Date: | Wed, 24 Nov 2004 00:24:57 -0500 (EST) |
(Because I'm so sick of the broken autoresponders bugtraq is full of, I've set the From: on this mail to a black-hole address. Please use the address in the signature if you actually want to reach me.)
Before a chdir to "foo", take stock: - record stat("."); DOTFD = open("."); (get a fd to ".")
This is not possible if . is a search-only directory. (While find will not work very well in such a directory, care should be taken that it not fall over just because someone happened to chmod the read bits away from a directory just when find happens to be in it.) More generally, I've wanted to do this - use file descriptors as handles onto directories - and often wished for an O_NOACCESS mode to open() in consequence.
Of course, open(2) will follow a symlink, if the directory we originally stat()ed is replaced by a symlink just before we issue the open() call. We of course can guard against that by issuing an lstat() on the fd once we have opened it.
ITYPM fstat(), not lstat(), in the last line. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse@rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
| Previous by Date: | STG Security Advisory: [SSA-20041122-09] cscope insecure temp file creation vulnerability, advisory |
|---|---|
| Next by Date: | STG Security Advisory: [SSA-20041122-11] JSPWiki XSS vulnerability, advisory |
| Previous by Thread: | Re: Changes to the filesystem while find is running - comments?, Martin Buchholz |
| Next by Thread: | Re: Changes to the filesystem while find is running - comments?, Casper . Dik |
| Indexes: | [Date] [Thread] [Top] [All Lists] |