ChromeOS: Appending boot times to symlink in /tmp is a security risk for developers.

ChromeOS: Appending boot times to symlink in /tmp is a security risk for developers.

BUG=492564
TEST=manual

Committed: https://crrev.com/f126b2a7afd3b6e6862df10202fae2332abe0349
Cr-Commit-Position: refs/heads/master@{#338784}

[Alexander Alekseev, 2015-07-14 01:30:05]

alemate@chromium.org changed reviewers:
+ achuith@chromium.org

[Alexander Alekseev, 2015-07-14 01:30:06]

Please review.

[Alexander Alekseev, 2015-07-14 01:30:12]

The CQ bit was checked by alemate@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-07-14 01:30:40]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1238613002/1

[commit-bot: I haz the power, 2015-07-14 02:11:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-07-14 02:11:17]

Dry run: This issue passed the CQ dry run.

[achuithb, 2015-07-14 06:13:11]

The bug doesn't have details about the nature of the insecurity. 

Could you explain a little about how this could be exploited?

[Alexander Alekseev, 2015-07-14 07:58:20]

On 2015/07/14 06:13:11, achuithb wrote:
> The bug doesn't have details about the nature of the insecurity. 
> 
> Could you explain a little about how this could be exploited?

If attacker has access to Chrome developer's computer, it can create symlink
/tmp/uptime-chrome-main to some file writable by developer. This can cause crash
applications, which can probably be exploited. For example, shell doesn't
distinguish between false program return value, and it's crash.

[achuithb, 2015-07-14 09:09:01]

lgtm

[Alexander Alekseev, 2015-07-15 00:24:33]

The CQ bit was checked by alemate@chromium.org

[commit-bot: I haz the power, 2015-07-15 00:25:06]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1238613002/1

[commit-bot: I haz the power, 2015-07-15 00:31:57]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-07-15 00:32:57]

Patchset 1 (id:??) landed as
https://crrev.com/f126b2a7afd3b6e6862df10202fae2332abe0349
Cr-Commit-Position: refs/heads/master@{#338784}