As far as I know, when I am creating a new file or directory in a directory that can be written by multiple users (and thus an adversary can have made a symlink there), the only way to protect myself from symlink race is creating a file with enough random name.

Well, some app might have checked if such file already exists, but I am not aware of any mechanism that is both atomic and able to detect symlinks.

So, when there are many non-random (or even reused) filenames in /tmp from various apps, it means all these apps are vulnerable to symlink race, doesn't it? (Well, it can't be simply decided if the vulnerability can be easily abused, but I don't care about practical exploitability for now.)

I hope I must be somewhere wrong.

  • Have you investigated mktemp? – MattBianco Mar 5 '15 at 10:08
  • 1
    There's you answer then. It is as common as there are bad implementations of tempfile creation. One way of atomically creating a file is by (hard)linking to it with (ln without -s). Only one process will succeed in creating the link. – MattBianco Mar 5 '15 at 10:14
  • 6
    open(..., O_EXCL|O_CREAT) you could also use fd=open and fstat(fd to check if file is a link without having the race condition. – domen Mar 5 '15 at 11:29
  • 1
    @domen Thanks, this looks to be more likely… – v6ak Mar 8 '15 at 14:01
  • 1
    @Infinite good catch. I wasn't clear enough. open with O_NOFOLLOW, then fstat to tell you if it's a symlink. – domen Jan 20 '17 at 20:16
up vote 5 down vote accepted

So this should answer the question of "is symlink common?"

A search on the MITRE database shows there are 4 CVEs for a Linux Symlink Race condition vulnerability. For comparison, there are 2749 Linux CVEs known to MITRE.

Linux at the kernel level has protections against this. Kees Cook created a patch for Linux to prevent this problem:

The solution is to permit symlinks to only be followed when outside a sticky world-writable directory, or when the uid of the symlink and follower match, or when the directory owner matches the symlink's owner.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.