Possible security problem, need information..

[Jonathan I. Kamens]

In article <1991Mar22.000333.22597 at scuzzy.in-berlin.de>, src at scuzzy.in-berlin.de (Heiko Blume) writes:
|> # [ls]
|> drwxrwxrwt  15 root     root         880 Mar 22 00:44 /tmp
|> -rw-r--r--   1 root     other          4 Mar 22 00:39 /tmp/test
|> -rw-r--r--   1 src      src            5 Mar 22 00:39 /tmp/test2
|> # mv test2 test
|> mv: test: 644 mode?y
|> mv: cannot unlink .
|> mv: permission denied
|> 
|> so the sticky bit works (i tried cp test2 test, echo bla>>test etc too),
|> but what does the 'mv: cannot unlink .' mean???? ain't got no clue...

  My guess is that you're working on a system that does not have a rename
system call, so mv works by unlinking the target name, if it exists, then
creating a hard link from the old source name to the target name, then
unlinking the old source name.

  Since /tmp/test is owned by root, mv can't unlink it.

  Although there appears to be a bug in your version of mv, because it tried
to print the filename and failed.  Probably a missing argument to fprintf or
something.

-- 
Jonathan Kamens			              USnail:
MIT Project Athena				11 Ashford Terrace
jik at Athena.MIT.EDU				Allston, MA  02134
Office: 617-253-8085			      Home: 617-782-0710