HEADS UP: Re: FreeBSD Security Advisory FreeBSD-SA-07:01.jail

[Colin Percival]

Dirk Engling wrote:
> Please try the "cp -f" before guessing, what it might do ;)
> 
> cp -f removes anything on that location before relinking the new file.
> Atomically.

No.  `cp -f` unlinks the existing file and creates a new file, but will
still follow a symlink if one is created between the "unlink" syscall and
the "open" syscall.

                    /* remove existing destination file name,
                     * create a new file  */
                    (void)unlink(to.p_path);
                                if (!lflag)
                        to_fd = open(to.p_path, O_WRONLY | O_TRUNC | O_CREAT,
                                  fs->st_mode & ~(S_ISUID | S_ISGID));


Colin Percival