From: bbense+comp.lang.ruby.Sep.11.02@...
Date: 2002-09-11T22:56:53+09:00
Subject: Re: RubyInline 1.0.4 Released! (fwd)

-----BEGIN PGP SIGNED MESSAGE-----

In article <20020910231812.GC15852@greed.zenspider.com>,
Ryan Davis  <ryand@ZenSpider.com> wrote:
>On 2002-09-10T17:52:14, Pat Eyler wrote:
>> From: Tom Gilbert <tom@linuxbrit.co.uk>
>> To: ruby-talk ML <ruby-talk@ruby-lang.org>
>
>> So looking at this example, I guess on the second "nonslow" run it found
>> /tmp/Mod_MyTest_fastfact.so there already and reused it?
>> 
>> I haven't looked at the sources or anything, so I'm just going from this
>> one example, but what would have happened if a naughty user had come
>> along first and created a /tmp/Mod_MyTest_fastfact.so that Did Mean
>> Things?
>
>You are absolutely terribly right! This was a known problem, but I
>wanted/needed to get more eyeballs on this more than I needed to have
>this totally secure and done. The first version (1.0.0--not publically
>release) just wrote to wherever $0 was running from, which is even
>more problematic. I'm open to suggestions (and diffs!) on how to
>secure this properly. (I just really want to keep this nice and small
>for now--at least until it has a real suite of tests)
>

- - Putting things in /tmp is just asking for race condition bugs. 
Here's an implementation scheme that I think might be
reasonable. 

1. Make a directory per user that is 700, if you want long
   term precompilation use a .ruby_inline directory in the user's
   home directory. You could also do something in
   /var/run/rubyinline/<user> on linux systems.  

2. Open the .so file and then do an fstat to make sure it is
   owned by the user and can only be written by the user. 
   It is important to check the file after it has been opened
   to avoid race conditions. 

- - This is probably not enough, but I know anything less has
  security problems. It would also be wise to check the
  entire path down to the .ruby_inline directory. For the
  most security you want NONE of the path components to	
  be world writable or group writeable. 

- - Booker C. Bense 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPX9JS2TWTAjn5N/lAQGpDgP+OhcsYT/RHkUTtJcTJ2oX4yJb3UN3rw6M
4oUMIXxMl6+n1VHjlKdroGXru8x+TDTKytZ6v0p5nzq60c5EbI35VVlGsa9EyLw5
Jfxnd1X1b4raU7dEjbPijdf7XO6rV9jvOOoWCFoXMlCIAioGRfQwOfQTPeOvx+ur
DL+z85f+3IA=
=/AHo
-----END PGP SIGNATURE-----