From: Ryan Davis <ryand@...>
Date: 2002-09-12T02:32:53+09:00
Subject: Re: RubyInline 1.0.4 Released! (fwd)


On Wednesday, Sep 11, 2002, at 06:56 US/Pacific, 
<bbense+comp.lang.ruby.Sep.11.02@telemark.stanford.edu> wrote:

> - - Putting things in /tmp is just asking for race condition bugs.
> Here's an implementation scheme that I think might be
> reasonable.
>
> 1. Make a directory per user that is 700, if you want long
>    term precompilation use a .ruby_inline directory in the user's
>    home directory. You could also do something in
>    /var/run/rubyinline/<user> on linux systems.

I was planning on doing this for 1.0.5 today.

> 2. Open the .so file and then do an fstat to make sure it is
>    owned by the user and can only be written by the user.
>    It is important to check the file after it has been opened
>    to avoid race conditions.

Cool! Thank you. I hadn't even thought this far out.

> - - This is probably not enough, but I know anything less has
>   security problems. It would also be wise to check the
>   entire path down to the .ruby_inline directory. For the
>   most security you want NONE of the path components to
>   be world writable or group writeable.

You mean I should bug out if $HOME is world or group writable and I'm 
planning on creating $HOME/.ruby_inline? I agree w/ world, but I'm not 
totally sold on group. Can you point me to something to help back that 
up?