Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 31 Oct 2017 20:33:30 -0600
From: Leonid Isaev <leonid.isaev@...a.colorado.edu>
To: oss-security@...ts.openwall.com
Subject: Re: Fw: Security risk of vim swap files

On Tue, Oct 31, 2017 at 10:54:08AM -0700, Tim wrote:
> Also, it almost never makes sense to put things in /tmp, for several
> reasons pointed out by others.  Making ~/.vim/... the default location
> clearly is the best solution.

And all those reasons make no sense. /tmp has a sticky bit precisely so that
people could put stuff there, as opposed to /run.

Just to clarify:
1. vim creates a swap file applying user's umask.
   Tested with vim on ArchLinux and vi on Fedora, if your vim doesn't do that,
   the corresponding package is broken.
2. It is totally OK to edit files in /tmp or /dev/shm or /var/tmp.
   The described "attack" when someone plants a /tmp/file.swp before another
   user edits /tmp/file is not going to work because vim will complain that the
   swap file already exists.

Cheers,
-- 
Leonid Isaev

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.