# Is symlink race a very common vulnerability in UNIX systems

As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself from symlink race is creating a file with enough random name.

Well, some app might have checked if such file already exists, but I am not aware of any mechanism that is both atomic and able to detect symlinks.

So, when there are many non-random (or even reused) filenames in /tmp from various apps, it means all these apps are vulnerable to symlink race, doesn't it? (Well, it can't be simply decided if the vulnerability can be easily abused, but I don't care about practical exploitability for now.)

I hope I must be somewhere wrong.

• Have you investigated mktemp? – MattBianco Mar 5 '15 at 10:08
• @MattBianco Sure, it is just an implementation of "creating a file with enough random name". Unfortunately, it seems that there are many apps that don't use it. – v6ak Mar 5 '15 at 10:10
• There's you answer then. It is as common as there are bad implementations of tempfile creation. One way of atomically creating a file is by (hard)linking to it with (ln without -s). Only one process will succeed in creating the link. – MattBianco Mar 5 '15 at 10:14
• open(..., O_EXCL|O_CREAT) you could also use fd=open and fstat(fd to check if file is a link without having the race condition. – domen Mar 5 '15 at 11:29
• @Infinite good catch. I wasn't clear enough. open with O_NOFOLLOW, then fstat to tell you if it's a symlink. – domen Jan 20 '17 at 20:16