WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] Instant Xen guest (guest-magic tool)

On Sat, Apr 14, 2007 at 09:51:42AM -0500, Gaurav Maheshbhai Patel wrote:

> The comment on /tmp/guestmagic was really good.
> I was wondering what if we use /tmp/$$ 
> 
> >     commands.getoutput('xm list > /tmp/$$')
> 
> Is it create the same problem as /tmp/guestmagic?

  Pretty much.  Process IDs are still *predictable* since they
 tend to be sequential under most systems.

  Still this is better than a static name.  You should really
 use a pipe.  If you can't then use a secure filename which
 can't be guessed by a local user.

  This is pretty off-topic for the xen list though, so I'll
 just suggest you look at the Secure Programming Howto:

    http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/index.html

 Specifically the section on temporary files being used in 
 races.

Steve
-- 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel