From 84a6d550d8ee06bfc7e346d0d7e70ae74e4fd3dc Mon Sep 17 00:00:00 2001 From: Stefan Nordhausen Date: Fri, 23 Jan 2004 06:02:10 +0000 Subject: [PATCH] Scott James Remnant * ltmain.in: Don't use the mkdir -p option when creating a temporary output directory so a symlink attack can't be used to arbitrarily chmod other directories on the system if libtool gets run as root. --- ChangeLog | 8 ++++++++ ltmain.in | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index d404feb02..b448a2155 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2004-01-23 Stefan Nordhausen + Scott James Remnant + + * ltmain.in: Don't use the mkdir -p option when creating a + temporary output directory so a symlink attack can't be used to + arbitrarily chmod other directories on the system if libtool + gets run as root. + 2004-01-23 Scott James Remnant * ltmain.in: new -precious-files-regex link mode option diff --git a/ltmain.in b/ltmain.in index c28a4da15..dff325658 100644 --- a/ltmain.in +++ b/ltmain.in @@ -5616,7 +5616,7 @@ relink_command=\"$relink_command\"" tmpdir="/tmp" test -n "$TMPDIR" && tmpdir="$TMPDIR" tmpdir="$tmpdir/libtool-$$" - if $mkdir -p "$tmpdir" && chmod 700 "$tmpdir"; then : + if $mkdir "$tmpdir" && chmod 700 "$tmpdir"; then : else $echo "$modename: error: cannot create temporary directory \`$tmpdir'" 1>&2 continue -- 2.47.3