From: Ara.T.Howard@...
Date: 2005-05-13T01:06:03+09:00
Subject: Re: ruby-dev summary 26090-26127

On Fri, 13 May 2005, Takaaki Tateishi wrote:

> Here is a ruby-dev summaries:
>
> [ruby-dev:26090] expand include path by -I
>
>  Nakada proposed that a path given with the command line option '-I'
>  be expanded at startup. This affects a library search path when we
>  change a working directory using Dir.chdir and so on. This proposal
>  have been accepted by Matz.
>
> [ruby-dev:26100] FileUtils.rm_rf security problem
>
>  Tanaka warned of FileUtils.rm_rf since a user possibly changes files
>  which someone tries to delete via symlink attack like the following
>  situations about Perl.
>
>    http://www.cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rmtree
>
>  There are following two solutions.
>
>    * Use chdir.
>    * Change a permission to 700 and change a owner.

what about making a tmpdir of 0700, moving to that, then cleaning the dir
under the tmp dir, and removing to tmpdir?  i think just doing a chmod will
fail on nfs since it caches inode information...

-a
-- 
===============================================================================
| email :: ara [dot] t [dot] howard [at] noaa [dot] gov
| phone :: 303.497.6469
| renunciation is not getting rid of the things of this world, but accepting
| that they pass away. --aitken roshi
===============================================================================