brson/multirust

Must ensure $multirust_dir isn't world-writable in order to avoid symlink race attack

Opened this issue · 1 comments

Cf. http://www.linuxsecurity.com/content/view/115462/151/

  1. Add -m 755 to mkdir -p $multirust_dir or wrap it with a subshell with umask 022.
  2. If the existing $multirust_dir should be world-writable, multirust should abort normal operation and ask the user to take some actions.
brson commented

Yes, good suggestion.