by G'Day,
scenario:
suid-root C wrapper:
char *envp[] = {
"PATH=/usr/sbin:/usr/bsd:/bin:/usr/bin",
0
};
main()
{
execle("/bin/sh", "use-mo", MO_SCRIPT, NULL, envp);
perror("execle of /bin/sh " MO_SCRIPT " failed");
exit(1);
}
with MO_SCRIPT pointing to a (root-controlled :-) shell script in
/usr/local/bin.
[Q] Is it safe to use a `here' document in the shell script?
My understanding is that `here' documents are created as temporary files in
/tmp and fed to the program via stdin. Now, if I guess to what the temp
file name will be and create a link in /tmp to some interesting system
file, would the shell detect this and not blindly dump the input on the
link?
Any input appreciated.
Regards
R'
--
Disinformation is not as good as datinformation.