Hacker News new | past | comments | ask | show | jobs | submit login

Novice question. Why the temp folder is problematic? Some cursory google search shows up this http://security.stackexchange.com/questions/11606/what-are-t...

But generally what kind of attacks /tmp folder enables ?




Consider the headlined article, for starters. A simple

    ln -s /etc/passwd /tmp/test_at.log
which any unprivileged user can quietly do, before running its examples for at, will ruin the system administrator's day just after 21:26.

This is the basis for many of the problems with files in /tmp : predictable filenames written-to without care by privileged processes. It is a widespread disease that is the reason that the systemd people arrange to run many programs with PrivateTmp=true .

In this particular case, root's own home directory would have made a much better private playground for the test_at.log file.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: