Time-of-check to time-of-use: Difference between revisions

Revision as of 08:22, 13 October 2023

Revision as of 10:09, 9 July 2024

Line 218:

[[File locking]] is a common technique for preventing race conditions for a single file, but it does not extend to the file system namespace and other metadata, nor does locking work well with networked filesystems, and cannot prevent TOCTOU race conditions.

For <code>setuid</code> binaries, a possible solution is to use the <code>seteuid()</code> system call to change the effective user and then perform the <code>open()</code> call. Differences in <code>setuid()</code> between operating systems can be problematic.<ref>{{cite web

| author1=Hao Chen

| last2=Wagner