10.2.4 Security Rules of Thumb
This section briefly summarizes rules of thumb for avoiding security
pitfalls.
- Protect archives at least as much as you protect any of the files
being archived.
- Extract from untrusted archives only into an otherwise-empty
directory. This directory and its parent should be accessible only to
trusted users. For example:
$ chmod go-rwx .
$ mkdir -m go-rwx dir
$ cd dir
$ tar -xvf /archives/got-it-off-the-net.tar.gz
- Do not let untrusted users access files extracted from untrusted
archives without checking first for problems such as setuid programs.
- Do not let untrusted users modify directories that are ancestors of
top-level arguments of
tar. For example, while you are
executing ‘tar -cf /archive/u-home.tar /u/home’, do not let an
untrusted user modify /, /archive, or /u.
- Pay attention to the diagnostics and exit status of
tar.
- When archiving live file systems, monitor running instances of
tar to detect denial-of-service attacks.
- Avoid unusual options such as --absolute-names (-P),
--dereference (-h), --overwrite,
--recursive-unlink, and --remove-files unless you
understand their security implications.