As far as the short-term solution to this problem goes, how about
this (untested)?
if [ -e $SOCKET_DIR ] && [ ! -d $SOCKET_DIR ]; then
mv $SOCKET_DIR $SOCKET_DIR.$$ || exit $?
fi
if [ ! -e $SOCKET_DIR ]; then
mkdir $SOCKET_DIR || exit $?
chown root:root $SOCKET_DIR
chmod 1777 $SOCKET_DIR
fi
First move other types of files out of the way, as before (is this
even necessary?). After that, we should have either no SOCKET_DIR or
a directory by that name we have created previously. If it doesn't
exist as a directory, create it.
If something by that name suddenly appears in the race after our
second existence test, then fail, since someone is clearly doing some
hanky-panky. Otherwise, we should own the file and there shouldn't be
a risk. I realize that the "|| exit $?" items are redundant given the
script's "set -e", but I like to see things explicit when security
matters, since some future maintainer might accidentally remove the
"set -e" for seemingly unrelated reasons.
Note that the "chown root:root $SOCKET_DIR" also seems redundant to me
(if we didn't already own it, we would have bigger problems, right?).
tim
--
To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120301195529.gj1...@sentinelchicken.org
