rm.racecondition

`Synopsis:  
  
If root ever does "rm -rf /tmp/foo" for a directory structure  
not completely owned by root, a local user can delete all files  
that root can.  
  
Such deletions are common for (a) /tmp cleanup and (b) before  
creating a specific directory in /tmp/.  
  
  
Details:  
  
"rm -r" implementations (Solaris 7, Gnu 4.0 checked) walk the  
directories, lstats files, and chdirs into directories (and  
recurs). Oh, and deletes stuff, of course.  
  
It is possible to replace a directory by a symlink, say "/",  
and have rm cheerfully follow it.  
  
The race window is small -- it will take thousands upon thousands  
of tries. Moreover, since the racing involves rmdir -- which  
typically is not very fast -- you'll need patience and "nice"  
and any other help you can get.  
  
  
Solutions:  
  
Maybe stat "." after chdir to verify that we ended up the  
expected place?  
  
  
Also affected:  
  
chmod, chown, chgrp. (Probably; this is guesswork.)  
`