backup: prevent a symlink attack by operating on the file descriptor
Use futimens() instead of utime() to change the timestamps on a backup file. Otherwise, a non-privileged user could create an arbitrary symlink with the name of the backup file and in this way fool a privileged user to call utime() on the attacker-chosen file. Import the relevant gnulib module to make sure futimens() is available.
Showing
+16 -11
Please register or sign in to comment