This is the mail archive of the cygwin mailing list for the Cygwin project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

/etc/profile set $TMP to /tmp. It's insecure!

Original $TMP and $TEMP is unset in /etc/defaults/etc/skel/.bashrc
version 3.9-3, which make %USERPROFILE% directory dirty. After some
disscuss at,
/etc/profile version 4.0-6 set $TMP and $TEMP to /tmp. Now any program
start from bash, create temporary files in /tmp, or C:\cygwin\tmp.

Cygwin program, which approves /tmp 's mode 1777, creates temporary
files with mode 400. That's OK.

Native Win32 program, which ignores /tmp 's mode 1777, creates
temporary files with mode 755. These files can be read from any user.
Win32 process may leak internal data, cause potential privilege
escalation attack.

I suggest that set $tmp (lowercase) to original $TMP, which is
meaningless for cygwin programs, and is recognized for Win32 programs.

Proposed settings in /etc/profile:

unset TMP TEMP
export tmp=`cygpath -w "$ORIGINAL_TMP"`
export temp=`cygpath -w "$ORIGINAL_TEMP"`

Problem reports:
Unsubscribe info:

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]