oss-sec mailing list archives
Re: Fw: Security risk of vim swap files
From: Tim <tim-security () sentinelchicken org>
Date: Wed, 1 Nov 2017 07:49:27 -0700
Also, it almost never makes sense to put things in /tmp, for several reasons pointed out by others. Making ~/.vim/... the default location clearly is the best solution.And all those reasons make no sense. /tmp has a sticky bit precisely so that people could put stuff there, as opposed to /run.
We've been spending decades fixing filesystem races that arise from cases where people use temporary files in world-writable directories. You have to get a half dozen things exactly correct in order to use /tmp. Why take the risk? Doesn't every normal (human) user account have a home directory that is already protected?
Just to clarify: 1. vim creates a swap file applying user's umask. Tested with vim on ArchLinux and vi on Fedora, if your vim doesn't do that, the corresponding package is broken.
Glad to hear at least some implementations are safe. But that is just one of several potential issues.
2. It is totally OK to edit files in /tmp or /dev/shm or /var/tmp. The described "attack" when someone plants a /tmp/file.swp before another user edits /tmp/file is not going to work because vim will complain that the swap file already exists.
I hope they got the TOCTOU correct... And as Alexander pointed out, /tmp is a bad place to put recovery files because everything is often wiped from /tmp at reboot. What's wrong with ~/.vim/ ?? You've argued that /tmp is OK, but haven't given a reason why ~/.vim/ is bad. I suppose you could argue that ~/.vim/{full-system-path-of-file} could get too long for the underlying filesystem. Fine, then store these files as ~/.vim/{hmac-sha-256-of-full-system-path} and call it a day. tim
Current thread:
- Re: Fw: Security risk of vim swap files, (continued)
- Re: Fw: Security risk of vim swap files Gordo Lowrey (Oct 31)
- Re: Fw: Security risk of vim swap files Jason Cooper (Oct 31)
- Re: Security risk of vim swap files Simon Waters (Surevine) (Oct 31)
- Re: Security risk of vim swap files Matthias Luft (Nov 07)
- Re: Fw: Security risk of vim swap files Tim (Oct 31)
- Re: Fw: Security risk of vim swap files Kurt H Maier (Oct 31)
- Re: Fw: Security risk of vim swap files Tim (Oct 31)
- Re: Fw: Security risk of vim swap files Steffen Nurpmeso (Oct 31)
- Re: Fw: Security risk of vim swap files Leonid Isaev (Nov 01)
- Re: Fw: Security risk of vim swap files Simon McVittie (Nov 01)
- Re: Fw: Security risk of vim swap files Tim (Nov 01)
- Re: Fw: Security risk of vim swap files Jeffrey Walton (Nov 01)
- Re: Fw: Security risk of vim swap files Kurt Seifried (Nov 01)
- Re: Fw: Security risk of vim swap files Jakub Wilk (Nov 01)
- Re: Fw: Security risk of vim swap files Solar Designer (Nov 01)
- Re: Security risk of vim swap files Ian Zimmerman (Nov 06)
- Re: Security risk of vim swap files Solar Designer (Nov 06)
- Re: Security risk of vim swap files Jakub Wilk (Nov 06)
- Re: Fw: Security risk of vim swap files Kurt H Maier (Oct 31)
- Re: Fw: Security risk of vim swap files Jakub Wilk (Nov 01)
- Re: Fw: Security risk of vim swap files Leonid Isaev (Nov 01)