Re: perlcc and permissions

[Yitzchak Scott-Thoennes <sthoenna at efn dot org>]

On Sun, Aug 28, 2005 at 10:08:34PM +0200, Krzysztof Duleba wrote:
> Baksik, Frederick (NM75) wrote:
> 
> > The command /usr/bin/perlcc is actually a perl script that performs
> the -r
> > check to test if it can open the file.
> 
> Thanks for explanation. I assumed that perlcc is a binary file. IIRC this
> is a known issue with perl scripts.
> 
> > So when perl does the -r check, it is correct based on the POSIX
> > permissions because your UID is not the same as the Administrators
> > UID you should not be able to open the file.  But when any program
> > actually attempts to open the file windows ( or is it cygwin )
> > will let it be opened.
> 
> Strange that bash works in a different manner:
> 
> $ [ -r foo.pl ] && echo ok
> ok
> 
> $ perl -e '-r "foo.pl" and print "ok" or print "failed"'
> failed

By default, perl's filetests don't check ACLs.  You can make them do
so with: use filetest "access";

It's interesting that perlcc bothers with the -r check given the following
in "perldoc filetest":

       NOTE: using the file tests for security purposes is a lost cause from
       the start: there is a window open for race conditions (who is to say
       that the permissions will not change between the test and the real
       operation?).  Therefore if you are serious about security, just try the
       real operation and test for its success - think in terms of atomic
       operations.

:)

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/