Re: /proc filesystem allows bypassing directory permissions on Linux

[Pavel Kankovsky <peak () argo troja mff cuni cz>]

Consider this scenario, pavel's actions are the same as in yours:

pavel & guest: cd /tmp
pavel: mkdir my_priv; cd my_priv
pavel: echo this file should never be writable > unwritable_file
guest: mkdir pirate_chest
guest: ln my_priv/unwritable_file pirate_chest
pavel: chmod 700 .
pavel: chmod 666 unwritable_file 
pavel: cat unwritable_file 
guest: echo got you > pirate_chest/unwritable_file
pavel: cat unwritable_file

pavel might have detected this attack if he checked the number of
hardlinks on "unwritable_file"  between the chmod's. But he did not
check that.

Yes, procfs makes it possible to circument directory permissions 
but it does not mean you are not playing with an armed grenade whenever 
you mix chmod with the number of the Beast.

-- 
Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
"For death is come up into our MS Windows(tm)..." \ 21st century edition /