Skip to content

Conversation

@Etsukata
Copy link

Currently, the default dump file permission is 0666. But there will be
no reason to let other users to read or modify dump files.

An attacker could inject some malicious escape sequences into a file,
which may be executed on a victim’s terminal emulator (Not Critical).

Currently, the default dump file permission is 0666. But there will be
no reason to let other users to read or modify dump files.

An attacker could inject some malicious escape sequences into a file,
which may be executed on a victim’s terminal emulator (Not Critical).
@Etsukata
Copy link
Author

@Etsukata
Copy link
Author

This PR does not mean the current implementation is vulnerable to symlink attacks. Because the sticky bit is usually set on /tmp and sigdump uses just /tmp (not sub dirs of '/tmp').

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant