[ofa-general] Re: [RFC] IB management changes proposal
weiny2 at llnl.gov
Thu Apr 26 20:06:18 PDT 2007
On Thu, 26 Apr 2007 19:47:04 -0700
Roland Dreier <rdreier at cisco.com> wrote:
> > > I'm sorry, I'm not familiar with the code.
> > > I was just saying that using /tmp/ibnetdiscover.topology is clearly
> > > a security risk since /tmp is world-writeable. Isn't it?
> > However, I think the risk is pretty low. The scripts only use this information
> > to report other information about the subnet. The only damage would be if an
> > admin misinterpreted this information and did something bad to the net.
> You're not being devious enough. Look up "symlink attack" to see one
> idea of something evil that an attacker could do.
0:-) I sit corrected.
More information about the general