Message-ID: <EDFD71CA-F00E-4807-BCEE-615EECD5679D@mit.edu>
From: Ken Raeburn <raeburn@MIT.EDU>
To: rt-comment@krbdev.mit.edu
In-Reply-To: <rt-6002-27542.10.5295830551947@krbdev.mit.edu>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Subject: Re: [krbdev.mit.edu #6002] krb5_rc_io_creat should use mkstemp
MIME-Version: 1.0 (Apple Message framework v928.1)
Date: Thu, 17 Jul 2008 23:23:55 -0400
References: <rt-6002-27542.10.5295830551947@krbdev.mit.edu>
RT-Send-Cc: 
Content-Length: 783

On Jul 17, 2008, at 23:09, Tom Yu via RT wrote:
> Ok, so this is a case where using mkstemp() is clearly less safe.
> What should we do?  tmpnam() and open(O_CREAT|O_EXCL)?  Some
> development environments are evolving toward warning about uses of
> mktemp(), which is similar to tmpnam(), so they may also flag uses of
> tmpnam().

Coming up with names not already taken isn't all that hard, it just  
requires setting up a loop and having a reasonably large space of  
names to work through.  With a large enough namespace and a halfway  
decent PRNG, we ought to be able to find an unused name in one or two  
tries, actually: dir + "/krb5_RC" + base64(random).

Do we have this sort of thing happening elsewhere, such that a utility  
function mkstemp_mode_0600 would help?

Ken