Re: ACT announces availability of GNAT 3.14p

[Florian Weimer <fw@deneb.enyo.de>]

dewar@gnat.com (Robert Dewar) writes:

> You misunderstand what I am saying. When the user asks for
> a temporary file *explicitly* (nothing silent about that),
> then the temporary file goes in TMP, which seems the right
> semantics for a Unix environment to us. If you are concerned about the
> security issue, e.g. if you are writing a setuid program in Ada, then
> most certainly I would advise against explicit use of temporary files
> in the Ada sense.

You are mixing two things here.  (Maybe I have been mixing these two
things, too, but I don't think so!)  The problem in GNAT 3.14p and
earlier affects *all* programs running on a multi-user system which
create temporary files.  As a result, you cannot use the Ada temporary
file facility at all, at least if you care about security.

My concerns regarding set-user-ID programs apply to the FSF CVS
version of GNAT only, where you can choose the path where temporary
files go.  (I hope there's consensus that the buffer overflow bug has
to be fixed, so this not worth a discussion.)

> You seem to be arguing for not using /TMP for temporary
> files ever, 

No, not really.

> but that seems the wrong choice to us in a
> Unix environment.

Exactly.  /tmp is *the* place for temporary files.

I just want that the Ada run-time opens the temporary file with the
O_EXCL flag for the first time (and retries if it already exists).
O_EXCL ensures that the test for existence and the creation of the
file are performed in a single atomic operation, eliminating the
current race condition.  (The FSF version of GNAT uses mkstemp(),
which invokes open() with the O_EXCL flag behind the scenes, multiple
times if necessary.)