• Kamil Dudka's avatar
    backup: prevent a symlink attack by operating on the file descriptor · 70bcf752
    Kamil Dudka authored
    Use futimens() instead of utime() to change the timestamps on a backup
    file.  Otherwise, a non-privileged user could create an arbitrary symlink
    with the name of the backup file and in this way fool a privileged user
    to call utime() on the attacker-chosen file.
    
    Import the relevant gnulib module to make sure futimens() is available.
    70bcf752
autogen.sh 776 Bytes