Problem - Kevin Tafuro

There are many other situations where security-critical race conditions occur, particularly
in file access. Basically, every time a condition is explicitly checked, one needs
to make sure that the result cannot have changed by the time that condition is acted
upon.
2.4 Determining Whether a Directory Is Secure
Problem
Your application needs to store sensitive information on disk, and you want to
ensure that the directory used cannot be modified by any other entity on the system
besides the current user and the administrator. That is, you would like a directory
where you can modify the contents at will, without having to worry about future permission
checks.
Solution
Check the entire directory tree above the one you intend to use for unsafe permissions.
Specifically, you are looking for the ability for users other than the owner and
the superuser (the Administrator account on Windows) to modify the directory. On
Windows, the required directory traversal cannot be done without introducing race
conditions and a significant amount of complex path processing. The best advice we
can offer, therefore, is to consider home directories (typically x:\Documents and Settings\User,
where x is the boot drive and User is the user’s account name) the safest
directories. Never consider using temporary directories to store files that may contain
sensitive data.
Discussion
Storing sensitive data in files requires extra levels of protection to ensure that the
data is not compromised. An often overlooked aspect of protection is ensuring that
the directories that contain files (which, in turn, contain sensitive data) are safe from
modification.
This may appear to be a simple matter of ensuring that the directory is protected
against any other users writing to it, but that is not enough. All the directories in the
path must also be protected against any other users writing to them. This means that
the same user who will own the file containing the sensitive data also owns the directories,
and that the directories are all protected against other users modifying them.
The reason for this is that when a directory is writable by a particular user, that user
is able to rename directories and files that reside within that directory. For example,
suppose that you want to store sensitive data in a file that will be placed into the
Determining Whether a Directory Is Secure | 45
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.