From owner-doc-jp@jp.freebsd.org  Mon Aug 18 01:24:16 1997
Received: by jaz.jp.freebsd.org (8.8.7+2.7Wbeta5/8.7.3) id BAA00408
	Mon, 18 Aug 1997 01:24:16 +0900 (JST)
Received: by jaz.jp.freebsd.org (8.8.7+2.7Wbeta5/8.7.3) with SMTP id BAA00384
	for <doc-jp@jp.freebsd.org>; Mon, 18 Aug 1997 01:24:12 +0900 (JST)
Received: from alice.my.domain by ns.gulf.or.jp (8.6.10+2.4W/3.3W9)
	id AAA20652; Mon, 18 Aug 1997 00:45:53 +0900
Message-ID: <33F70FF3.41C67EA6@cheerful.com>
Date: Mon, 18 Aug 1997 00:40:04 +0900
From: Nishika <nishika@cheerful.com>
X-Mailer: Mozilla 3.01 (X11; I; FreeBSD 2.2.1-RELEASE i386)
MIME-Version: 1.0
To: doc-jp@jp.freebsd.org
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Reply-To: doc-jp@jp.freebsd.org
Precedence: bulk
X-Distribute: distribute [version 2.1 (Alpha) patchlevel=20]
X-Sequence: doc-jp 3103
Subject: [doc-jp 3103] <WWW> security.sgml
Errors-To: owner-doc-jp@jp.freebsd.org
Sender: owner-doc-jp@jp.freebsd.org

$@$K$7$+$G$9!#(B

$@=PD%B3$-(B, $@EZF|A4LG(B, $@$*K_5Y$_A4LG!D$H!"(B
$@$+$J$jCY$l$F$7$^$$$^$7$?(B. $@$D$$$5$-$[$I(B,
$@Bh#10F$,;E>e$j$^$7$?$N$G(B, $@CY$l$P$;$J$,$i(B
$@Aw$i$;$FD:$-$^$9(B.

$@K]LuCf$K5$$E$$$?$H$3$m$r?tE@(B...

$@#1!'(B man $@%Z!<%8$X$N%j%s%/@h(B

   1.4 $@$+$i(B 1.5 $@$X$NJQ99E@$O(B man $@%Z!<%8$X$N(B
   $@%j%s%/$NDI2C$G$7$?(B. $@$3$N%j%s%/@h$,$I$l$b(B

      http://www.de.freebsd.org/de/cgi/man.cgi?hogehoge

   $@$C$F$J$C$F$$$^$9(B. jpman $@$K7R$2$?$[$&$,(B
   $@$$$$$N$+$b$7$l$J$$$H9M$($F$k$s$G$9$1$l$I(B
   $@$$$+$,$G$7$g$&$+!)(B

   $@$^$?(B, $@$=$N>l9g(B, $@$I$N#U#R#L(B($@$H$$$&$+$I$N(B
   $@%5%$%H$N$b$N(B)$@$,(B jpman $@$N8x<0#U#R#L$K$J$k(B
   $@$s$G$7$g$&!)(B

$@#2!'(B $@L$LuItJ,(B

   $@0J2<$NC18l$K$D$$$F$OE,@Z$JLu$,8+$D$+$j(B
   $@$^$;$s$G$7$?(B. $@::FI$NH?1GCJ3,$G5[<}$7$?$$(B
   $@$H;W$C$F$^$9(B.

   <exploit>

      security@FreeBSD.org $@$G$b$h$/8+$+$1$^$9(B
      $@$1$l$I(B, $@E,@Z$JLu$,$"$j$^$7$?$i(B, $@$465<x(B
      $@4j$$$^$9(B.

   <race>

   <P><LI><A NAME="#rule1_3"></A>All uses of mktemp(), tempnam(), mkstemp(),
   etc.; make sure that they use mkstemp() instead.  Also look for races in
   /tmp in general, being aware that there are very few things can be atomic
   in /tmp:
                        :
   mkstemp(3) properly handles this for you, so all temp files should
   use mkstemp to guarantee there's no race and that the permissions
   are right.

      $@$3$A$i$O$"$^$j0UL#$,$h$/DO$a$^$;$s$G$7$?(B.
      $@$3$N(B race $@LdBj$K$D$$$F>\$7$/=q$+$l$?$b$N$,(B
      $@$"$j$^$7$?$i(B, ($@>pJs%]%$%s%?$@$1$G9=$$$^$;$s(B
      $@$N$G(B)$@65$($F2<$5$$(B.

$@#3!'(B $@DI2CBT$A$NItJ,(B

   XXX This section needs to be written.

   $@$H=q$+$l$?ItJ,$,$"$C$F(B, 1.5 $@$+$i9`L\$N(B
   $@DI2CBT$A$N>uBV$K$J$C$F$$$^$9(B. $@$^$?(B

   <P><LI><A NAME="#rule1_5"></A>Understand the differences between uid,
   euid and svuid in 2.1 and 2.2.  We sure don't. [XXX but we should find out
   and fill this in after talking to Bruce]

   $@$H$$$&ItJ,$b$"$j(B, $@9g7W#32U=j$,DI2CBT$A$K(B
   $@$J$C$F$$$^$9(B.

   $@DI2C$5$l$k$^$G$O(B, $@$3$N$^$^CV$$$F$*$/$D$b$j(B
   $@$G$9(B.

-- 
Nishika
http://nishika.home.ml.org/
mailto:nishika@cheerful.com
mailto:nishika@usa.net


----- Begin of security.sgml.gz.uu -----

begin 644 security.sgml.gz
M'XL(`(P.]S,``[5::5O;R++^'/["?!&F15B,Y0WPOJ^R+4,PA`Q)B!<!PL9F
M9#G;F>2WWZKJ;DDV)I/#W#//$"S175U[O57MS&:E6^Z].ZDJC5ZGK9R<E]K-
MLA(XT+2WL;*F57H5_H=8**II52.@7&UD-JM&K]E[IXSZCJD$6`5^I91(,GFL
MA>'_0R4:2X6CJ?BQP@(Y;[5C.1-87K--LW164<[,X<*VG&]*?6&-3/]"5;&F
MP\EB9,Z5LW=GO6I'"<@7H?GMPR204U3Y(KWQ`7<>'"BL.6+*P4%.X8^].U.1
M1^G]Q_[4G)M*939</)A3I^]8LZER8L_NS:'CV]2UK5MKVI\HMOG9FL,:$"MT
MB`LV-C*H!CBK42U6<AN*HF2`V78U)P_Y@Q74M'J@FNJ]6E.WU*#*U.8?.Z6,
MQM?1EDZU5U2,8J>:#107SMW,#BCEKM$#P;,!?6:/^E.EL1@,^O8(%:+QLS*E
M;N6=TJM>PJ*M,/T74$KU<K?=?0-O:O1?0&DWC998@(\7XCD!SPG84!3/M=H&
M42"1(K_!/BR"I>9#KMV?.\KY(UI]E%)6S1Y1PK'48305"2M,R6BP'G:=Y(`N
MBS&#TV/=4IYIS`"ZRC,',Z.\E>^P%KMC959+-]B,35B-,38.EXIQIL/6#=QR
MK"9A^2?6X*_5V&8&Z-O9OX!^GO7Y&3WK<8X'L!$]V=9PS)]MM4E']M6YVHAF
MV3$<M\T:@C@\YMF`&:S.DO`JA%MBX:;#C.31\8#M,VM5`,F-G;'8F)^?=[BL
M^H_6)E$.$ND!$,_"60S$RQ.Y8+)'0N;3/T%L!N1;S;\/)RP)[TX8_F?`NP;\
MW@9--I@=NV07DE,Z*G.?7;`(_$F'PU&0EEI7CT#A<W8HM/?1DP0^YY$=/^/J
M6_5!#:N6^I$%)>D[=K]D&#M\GHFP8W>KWUNN0/MC9J>F:#20\",P@8SHG..L
M%?];D"WKL2"KMYHLS'DG]0Q2[UD:-@;8O>1TR7G^!/()4$X%)*G!<XP;CHTJ
M_RD<,B-]6=UF7?A;!2PVB.>//P(+JU(/B/4-3C+&6G1DGC']-)ED03AZ#/KO
MDG29OG)GFS?9P$/?FCBSU%RDJH/9S8TU-.W"#9A^,!^%9O8MQ-$SGHP^TN4;
MYAFMGQ.ZKZM]KJSB%U16-`,V8D+B1C2WUJO(QUO@$6-/:3PVHQAEYYB7VLW<
MY>4EY#UKK@##E.&FICF:*\Y,&9C*%Y#`,:<A2"NXG@Y;X;@]*MVC=T?GS;__
M^\/ZD_GLMT[T?,W@)[!W[`!^X&26RB9\9YWDW.,R,F]NV8N)&0GD,EJ1_*/)
MYDRO_32Z:A;TFF2#?*AS"O;7P?XQ"CQN_PKH_MYUWICZ$3P($QSF97QC8;R$
MO^<=N29>.3K03[WGPG7E7CU7-V'=6+ZK_BR;F"W0UN>5$R)TJD;4LMIPC[H"
M*S;:N70TQ[,`/R]^F7?P-."S*9>"+!.7_QIY=`2X3K.Y*T46_!A^Y(X,Q'T&
M,V5>K8/T^4J24ITXHS;HU%@09(5841_(ZWA<C$5VTRFYZ)3/.+/2-I_8"#D$
M'K(0;T3;HPOI,Z;V-C/H(YBTR@_A<V;#6@M"'FWIRYL8OYD9T%CU,_MPSJ+`
M"2HEM4'549@;/SZU^+5G<\[/T4%LF]F1*[8CLIXN.'3#]\YQ'E.:]N7+E]#(
M#/F"5AN9VO#6TA[ZTQ#\SL\=>_CX;2>V&Z#3W4<W;*E^9/KXQ_^6]*-M39T;
MC[;[+(F3GHU$C9UE3RA'N?G*M6E0#T)TE(7M7(N]6-CIBK33->*^D/AT5=[I
M>H%M*.W;J-4=.A'2+\C6=2,A"Y$0A"4[GH^BO=6B^AJ"2V.VYXWI]QB!>ALR
MU1YDU0:[3OYDGY#TKL+K&!1$='POU5+HE%(?7J[$6].9DXSB`\HFH^-?:.\?
MG85U4UL)\_@.Y1'@:$PUMBN*IT@6;D"M":0H#R2P.X!<H.UY.`AC3C_+5T;G
M$3)1"W1F0_:,L+$O`\C,*HCP#=WX17A(R8C20^%.3Z2_&W-FQ_5R!"JNAPYD
M:2;MBU,%C>)5Y9Y@RQ@<_Y#2RA@Q$0]T25&_@.2#<@]\H`&)'0CV)I",NKYT
M5H=2<X8_P(6%U!%['=I5$#,\`?$0/$DZ/!4FU3RZFB>T883OV"4S`&,>@(M=
M0XH4)8*U.MGB%6$[G0(U7^XP&PL&O-EGG94D'H!5>4*HLOAX?`9=FG8-2UM]
M.>1QM7Z225;WP*?A'85'8[E0^&W_,C^</9K3G2@XH?CP_^3=T'<15?'!1Y6G
MA,0^]S,R58O$#:!V`JH&Y2,I4;HL8K(8<\@J-.F^`_0T5]]#P0$;PK]S2!H%
MM`SHK$G(=`S/#VQ[<Q=V!TBT1F:_/2+JN-:%9<]'4HQ'TLO4\3!VS(='-];=
M1U1+\&7%!BE,^P\N3?'\+R@^C.<K7,Z7V!2V([5?J_>`Q1N=4U!;&O]2RH'C
M(M)HE4Q(51#\+_:=7_-!U@OZFT71*1GUU\N9GZRI.0^/?$OBJ/Z=`FGL:U>Z
M[`K^G8.;"`Q).;"*O0?YI-Q>OG%CV.X/35ZUB^_)@:Y]AZ8V7A&N>84N1/`%
M.J8)>&4#%9::%D(^L#1AW4(H\8W@]WXF5>_Q3Y0U>6-$9+K7Y3?58D_Y6^E>
M5R_+;?+]`?7`=0!;,@H,=0_>O54Q+\!&3<*K_X7^NR+K&ESW,LL1Q&]!FW;,
M-+6+H%O`4`U6^ZH`K_K;I&%7G39EZY38SPX_1RN)`+10-:#S`?+EO1?OJ$=>
M-_CY7D[0/^3^)"VV"&"XO/."8Y/;Z)!W>+L=$8BC+OO0Y\,_[B)2+":9'@M6
M@]7/3$<LXC9OT-7(EL#/5/4>T&_>UY&X:SQ,#P4I*3OZ(\UU:^B?`6.OX$`$
M0J/R%@OB=LB-!!VA\H:Q<UQJ`9)+9,`"7D]/L,OR5R8X-.4V);@>E8,A[:^7
MOU32(5=2-!3A.18M$`U%Z:'%]@2N4,Z;E:!2I7_/+N`71R`>(P`L`(=T?D3M
M%2CWUE3F"]M41K/I:R>D7&%?.E@XRA=X?S=;3$;*C34=*;.%@Y3Z4WR>3!0'
M6U<+NM8;Q[05IS\96]-;;%Q+]F)H?OB51$=>(X)Z/8=H#GM^R#T5GG=!VQ_)
MI"V?/G4)XUV="^@;O^P&U!O8@_,4/G&INSZ]O`-:1DQ3Z;>^E,HC\$G#J)_*
M&0S:'>#S$#A&7+4#YX+#NS3?`$K!B,Q#7K*`ZWUH[WQU%2Q?!BK0#/HH'H-'
M[%,L\XE/'7[?4@BG*#]F6I_;.39*%!(3@=MXLRMK]:F:A+\;D$=10\IK[;4'
M15^'0AK]'^(O&WQB!GJ]QS8?L!GE-Z3+@K6?V(CZ-4&:/&(&#@:8_5Q+35:V
M9S,'-R4"B1*KX]ESTUE8(UXA`'B@"5TC\#J16Y0N*`@.W*/X5%`PT,F#@@EF
M(KT]=TX!3WL^T9_M]7_E?L<K?3`S8GH]PU,?3=-:\4NB::Q,HZ3:^;!NE#$!
M_'KH?J4]6I-B#9%^NWQ.@9(=A<,\D-=X^#\@TU6Q$JY8S5RT2.+DH7+A6.8=
M,`SY)O>H`_)/_T#ZF9)W8K+G(D(/1^,P:8_R&]18&C@8<D;LPDR#^]VM;7(X
M8+-]GQR1-2.8_]%XP>!>12@X2"7[!+0.Z1I8VH-@2TKWI\"[`Y$&-)<2K/)!
M,]\'/WRGH49H'D:C3:QG,M2W(LD>_DAU5)K"8!J[\XG/FV9_7?PM,R:]R1P'
M`,%U1LP8K'8X)8G04(VE@E,6.`M3B,;]S/SZ.)E9%*:B"FD$VOA4?`;,U5<[
M8,4KR]UFL//6'0]1[^^)+_L\P!BGU&^)\;XVL*;:_(X[!FYPVP\.R+#9F_AT
M@BH1<\YUFA%-MZQL=KS9^>%5]Z?C"1<+29&Q78DL)?L1`*HUNN4E7VAX[+O%
MH/+J%6'W`3K5/TN7V%U[Y$ECJQI]H?=3-H6NCWZO=),VS7C&H(,B:]%G>>51
M]]T#/%5GS$N".ZJ%[@Z\\LG#:D4V:`QJ%T:E$W^>BMZUVZS5S&9VQ+#X&4,D
M>XV+Y,T20@(/.38Q5&DL!^&1S>I!EV'?//D"\R?7]AFH6SNK"YT':3;@%A5?
MWFHMH>A@H@`J^?A+57@H],F,U:T$DOU$MI0@(,"=WS^"F*AGJDF*7+H^^XW1
M;-P_FO7?"J$=L/M.NE<W(B7$C'QH:83W`_[V9!C=?@_)J4T"#&BT3)V$I%$(
M@V;R;A0+]GT!`F+B1>+J-0N!2;Q/,:``(P!E7KH!:P*J;?\5?60Z'U*'O[.#
M0PUL<;A4X9CL+T$.B8K1A;O@?]<$&-8-\%.[SV?.N!S+E2_.Q`T%)V00+C%<
MX.W.2.GB:IT%[50]8;(69"P("+I+S0HJO!9XK7'RR;0>5N8[2T!*4FVDZMD]
MJB\)]5:=0WVI(!3#@1AT*_<T$#.,G/Z#0TW>-Z,Z?=3^L5V(7_L"6YXL#(GR
M`F+!>S,.]OCT@4:++YXK//:=X=U.!"JS_+24G:";JW$<)]*#O!4CX#"<31WS
M*Z]*B!R4Q=0:63<W^.*XF`GS*))O^,@;Z?@TLB;AN(GK(YP59PV0EX_YZNZZ
M3:4BB7:Y`FI-]HEG#!]Q7C9X=[?#4SV4.7T+[QMRD^P]J]<B>'\C+J#'W*-(
MM]0;4\.X3V,$NEOS\UV8U,.R@92<U\H5A%D,6PPHJG,*?!S1ZO(ZN%:&WECO
M_.C$\*86I?)H@G^ZW?#1-@2^@:-0".UWA&-(4ZGI44..DY=L(>_/`&.3%`-!
M-Q8*'PP7MFU.N9DNL8%))D45=U/^[PW\XKZ.7R8>HF8+7LX\7OS>Z\F8[T"+
MCBEI7`RS5B57>`^),HE=/]B`7X?\(>\J8?\83@#N8BGP0\S:`X@]D]\>+X,9
M<<K*A8=?*DJH!?"D?=:*+MQN!C.*FSSI>P\^B[`&M)C;$'M=&MC[1]A%-@1=
M-P3W2U$!G7[0[?"IEP,CX$/.Q-F4+V$%P+FVZ2(_R!$:LQ*%I6S-Q_E4'A/J
M:QR9\1O)]OOJ'A`3I3)>\8BBQW1.P^<D?^!W1A1Q.:+P9]TD]E*;279)\SN\
M5_!Y$71O9;5(H;8LJ!AR4-V?PXH6&R1OA>^WFD&6RL<A!T>>#"2?X<L;-#1[
MI"!1_)(JYEJW"6Y)7_2T@%<4\:2X/:NOJ),P3'<UO4)(^(`W'6>(``T*M_*E
M\MI?49OIZ6KZ,\WH")RN%)*)"`OHLMJ%&-`Z3&=/P0<,"G_YC0M_YP@T,`R>
M"<M_`-B>$<N1\`34PV>-%JOK6VE01/8.`+?MTO=U`W[T]5P[#&I\H!_=`W8X
M_^6M%[\J]XWB4K7:3YY^*U]Q[$B`XTF+\HPD1__F5L$V^Y/);.@VF]ZSUVU"
M'6)0IX&OU#OP2(/?W^NOET+/O4SCHUO?<%W"'^^V%M_()@Q;LT^PXZ%YVFB!
M0A$\>2,OW_WA$X2/-:!>N:\DH?LM8Q7D%3,W2=ZZ657\13T$(Z0`@&/VI5$!
MQAKDMGW@PV(IGW%Y;%"LSJWOYNS&-_?U!A5!GK\:6H'P,0=_[K>46M*TJQ0Z
MI[_JX8SARK<<0,JS7M.HYS9>#>_ZMC)8W%Q%PM'XA_3&J[EC+X:.<C.;*?]1
M0J&0\@->PN^-4K&2VGCU]>O7'5@>5'#]+G_^]NU;4++D;=_=W:AWNTM[Q!KX
MO+MF*WR&UQG-94X:)$!,`LFKK:VM#_R.;-TE'?+L=RS;O:8'E<BQA,\D8K3!
M<;4?3:_>UM#JY;&&'9TW;(FY!<T="<"":S8$Z9C[6L%7(6EN)]>GZI4AHA%W
M$&#G=QFKO..L^7QV#0)\D,'%\99T3[HIMN&8M:[A=WBOM2_V&>-?CI,`\/`@
M^R;]!K2I$1!+/>=J7DQ!6F\FLI]J/[,G1M>-(M$`NQ,!=X94NBW\*8:YSS6O
MZAA.+B+<AVSGCI#</FX?;)=?Y3<W`Y!988FE@'^2TS=I)(FJD-\/VP8_<DP[
5#<_XC5?Z`BQ]Y_;_`.0D_@VD+```
`
end

----- End of security.sgml.gz.uu -----

