Original $TMP and $TEMP is unset in /etc/defaults/etc/skel/.bashrc version 3.9-3, which make %USERPROFILE% directory dirty. After some disscuss at http://cygwin.com/ml/cygwin/2011-03/msg00211.html, /etc/profile version 4.0-6 set $TMP and $TEMP to /tmp. Now any program start from bash, create temporary files in /tmp, or C:\cygwin\tmp.
Cygwin program, which approves /tmp 's mode 1777, creates temporary files with mode 400. That's OK. Native Win32 program, which ignores /tmp 's mode 1777, creates temporary files with mode 755. These files can be read from any user. Win32 process may leak internal data, cause potential privilege escalation attack. I suggest that set $tmp (lowercase) to original $TMP, which is meaningless for cygwin programs, and is recognized for Win32 programs. Proposed settings in /etc/profile: ORIGINAL_TMP=$TMP ORIGINAL_TEMP=$TEMP unset TMP TEMP export tmp=`cygpath -w "$ORIGINAL_TMP"` export temp=`cygpath -w "$ORIGINAL_TEMP"` -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
