Re: [PATCH] Re: Insecure tempfile creation

[Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx>]

Bart Schaefer wrote on Sun, Dec 28, 2014 at 20:01:42 -0800:
> On Dec 29, 12:49am, Daniel Shahaf wrote:
> }
> } Your patches look good to me, including the rmdir
> 
> I avoided using "mkdir -m 0700" in favor of the chmod but then found some
> other places where mkdir is passed the -m option.  So maybe that should
> be tweaked.

Coming back to this, it has occurred to me that

	mv -f =(:) ${TMPPREFIX:-/tmp/zsh}foo$$

wouldn't perform an atomic rename (as intended) if /tmp/zshfoo$$ is a
directory or symlink-to-directory.  So hypothetically an attacker might
be able to create a file named `basename =(:)` in a directory of his
choice owned by the victim.

I realize this is more far-fetched than the previous scenario.  Do we
consider this a problem that should be fixed?

Cheers,

Daniel