From: dagbrown@... (Dave Brown)
Date: 2003-11-25T11:42:13+09:00
Subject: Re: Message "Insecure world writable dir ..."

In article <1069713722.820077.32089.nullmailer@picachu.netlab.jp>,
Yukihiro Matsumoto <matz@ruby-lang.org> wrote:
: Hi,
: 
: In message "Re: Message "Insecure world writable dir ...""
:     on 03/11/25, Dave Brown <dagbrown@LART.ca> writes:
: 
: |On every Unix system in the world, /tmp is world-writable, but it
: |also has the "sticky" bit set: permission 01777.  That's not
: |considered to be an insecure permission setting; only the person
: |who owns a file in /tmp can remove it or modify it.
: |
: |If Ruby complains about a directory with permission 0777, then it
: |has a point, but if it complains about a directory with permission
: |01777, then it's being overzealous.
: 
: Don't worry; sticky bit is checked if S_ISVTX is defined.

How about this case then?

    :) [/tmp] irb
    irb(main):001:0> system("echo hi")
    (irb):1: warning: Insecure world writable dir /tmp/., mode 041777
    hi
    => true
    irb(main):002:0> 

My feeling is that it's being overzealous there.  (It does that
with exec too.)

--Dave