Jay Lessert <jayl AT accelerant DOT net> wrote:
> On Wed, Aug 27, 2003 at 01:33:01PM -0400, Jeremy L. Mordkoff wrote:
>> My policy is to never restore files in place.
>
> I agree that is a good practice (doesn't prevent Chris' student's
> proposed exploit, though).

Actually, I think it might.  If we restore to a temporary location, then
the /etc/passwd (from my previous example) won't be overwritten.  The
malicious user couldn't move it manually (since they wouldn't have write
permissions through the softlink).


--

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Chris Barnes                                       AOL IM: CNBarnes
chris-barnes AT tamu DOT edu                            Yahoo IM: chrisnbarnes
Computer Systems Manager                               ph: 979-845-7801
Department of Physics                                 fax: 979-845-2590
Texas A&M University