bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

More secure temporary files for Linux

Summary

In 2013 Linux 3.11 allowed temporary files that are not visible in the file system at all. For this purpose the open() and openat() system calls received the O_TMPFILE flag. This removes the basis for attacks in which attackers gain higher privileges via predictable names of temporary files, for example using symlinks.

Ideas

  • A file without a name in the directory cannot be redirected by a symlink.
  • Symlink attacks exploit predictable file names in shared directories such as /tmp.
  • If required, the file can still be given a name later using linkat().

Insights

  • Some classes of bugs are better eliminated by a new interface than by many individual fixes.
  • Security also comes from taking away the names attackers aim at.

Facts

  • O_TMPFILE was introduced with Linux 3.11.
  • The extension concerned the open() and openat() system calls.

References

Critique

  • The report does not explain that O_TMPFILE requires support from the file system in question.

Recommendations

  • For temporary files, use O_TMPFILE or mkstemp() instead of home-made file names.
  • Give services private /tmp directories, for example via PrivateTmp in systemd.

Read the original article

Search the Web Archive

hß · 2021

Intel closes security holes in laptops, Linux drivers and more

In August 2021 Intel published updates for several holes in drivers and hardware. The most dangerous was CVE-2021-0084 in the Linux RDMA driver for the X722 and 800 series Ethernet controllers, through which attackers could gain higher privileges. Further holes affected NUC laptop kits, graphics drivers, Optane PMem and the 800 series Ethernet adapters.

hß · 2026

iX workshop: hardening Linux servers with encryption and access control

In 2026 heise again advertised the five-day iX workshop “Hardening Linux servers” with Florian Winkler of B1 Systems, this time with dates in September and November. Topics range from physical security through encryption, two-factor authentication and SELinux/AppArmor to logging, monitoring and intrusion detection. The target group is Linux administrators and security officers who want to secure their servers systematically.

hß · 2025

iX workshop: securing Linux servers effectively and comprehensively

In 2025 heise advertised a five-day iX workshop on hardening Linux servers with trainer Florian Winkler of B1 Systems. Topics were encryption, securing network services, two-factor authentication, SELinux and AppArmor, as well as log analysis and intrusion detection. There was also an introduction to penetration testing and practical exercises via SSH in a training environment.