Must ensure $multirust_dir isn't world-writable in order to avoid symlink race attack
Opened this issue · 1 comments
nodakai commented
Cf. http://www.linuxsecurity.com/content/view/115462/151/
- Add
-m 755
tomkdir -p $multirust_dir
or wrap it with a subshell withumask 022
. - If the existing
$multirust_dir
should be world-writable,multirust
should abort normal operation and ask the user to take some actions.
brson commented
Yes, good suggestion.