diff options
| author | Otavio Salvador <otavio@ossystems.com.br> | 2008-05-23 10:07:44 -0300 |
|---|---|---|
| committer | Otavio Salvador <otavio@ossystems.com.br> | 2008-05-23 10:07:44 -0300 |
| commit | f659b39ab985d28e4b6618a1146ca8569abac253 (patch) | |
| tree | 057996e68cc1f3fe1ee6d781dc5a586ac35558c0 /apt-pkg | |
| parent | e213cdd3ba997ef7368d071ed4b6357f2d947360 (diff) | |
Apply patch to avoid truncating of arbitrary files. Thanks to Bryan
Donlan <bdonlan@fushizen.net> for the patch. Closes: #482476
Diffstat (limited to 'apt-pkg')
| -rw-r--r-- | apt-pkg/contrib/fileutl.cc | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/apt-pkg/contrib/fileutl.cc b/apt-pkg/contrib/fileutl.cc index 2b7e25080..a5976cf3a 100644 --- a/apt-pkg/contrib/fileutl.cc +++ b/apt-pkg/contrib/fileutl.cc @@ -138,7 +138,9 @@ bool CopyFile(FileFd &From,FileFd &To) close at some time. */ int GetLock(string File,bool Errors) { - int FD = open(File.c_str(),O_RDWR | O_CREAT | O_TRUNC,0640); + // GetLock() is used in aptitude on directories with public-write access + // Use O_NOFOLLOW here to prevent symlink traversal attacks + int FD = open(File.c_str(),O_RDWR | O_CREAT | O_NOFOLLOW,0640); if (FD < 0) { // Read only .. cant have locking problems there. |