As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself from symlink race is creating a file with enough random name.
Well, some app might have checked if such file already exists, but I am not aware of any mechanism that is both atomic and able to detect symlinks.
So, when there are many non-random (or even reused) filenames in /tmp from various apps, it means all these apps are vulnerable to symlink race, doesn't it? (Well, it can't be simply decided if the vulnerability can be easily abused, but I don't care about practical exploitability for now.)
I hope I must be somewhere wrong.
mktemp
?ln
without-s
). Only one process will succeed in creating the link.open(..., O_EXCL|O_CREAT)
you could also usefd=open
andfstat(fd
to check if file is a link without having the race condition.open
withO_NOFOLLOW
, thenfstat
to tell you if it's a symlink.