Re: [PATCH] Re: Insecure tempfile creation

[Daniel Shahaf <d.s@daniel.shahaf.name>]

Bart Schaefer wrote on Thu, Jan 08, 2015 at 00:08:21 -0800:
> On Jan 7, 10:48pm, Danek Duvall wrote:
> } Subject: Re: [PATCH] Re: Insecure tempfile creation
> }
> } On Wed, Jan 07, 2015 at 10:22:20PM -0800, Bart Schaefer wrote:
> } 
> } > On Wed, Jan 7, 2015 at 2:03 PM, Daniel Shahaf <d.s@daniel.shahaf.name> wrote:
> } > > Coming back to this, it has occurred to me that
> } > >
> } > >         mv -f =(:) ${TMPPREFIX:-/tmp/zsh}foo$$
> } > >
> } > 
> } > Hmm.  Yup, we need "ln -Fh" instead of "mv -f".  Are the -F and -h
> } > options of "ln" fairly standard?
> } 
> } Neither exists on Solaris ln.  GNU coreutils ln doesn't seem to have -h,
> } either.  And -F just seems like a bad idea, supported or not.
> 
> -F on MacOS (where I was reading the manual) is like -f in coreutils,
> not like -F in coreutils (sigh).  And -h is --no-dereference.  
> 

So, for clarity, the flags you proposed mean "overwrite destination if
existing" and "if destination is symlink, don't dereference it".

> Fortunately, we have the zsh/files module which provides a buitin "ln"
> with well-defined semantics.  Hopefully that's good enough.

Another option: add a builtin that wraps the rename(2) syscall, and
then use:

    zrename =(<<<'') ${TMPPREFIX:-/tmp/zsh}foo$$