From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id BE773385840A; Wed, 11 Oct 2023 16:09:08 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org BE773385840A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1697040548; bh=c0niUOUC4Mi231QE8eBea/s4M5i0yRrO+EvdzNbER9Y=; h=From:To:Subject:Date:In-Reply-To:References:From; b=JEJx84O/yBRsM8sJADAT9S70roXje7ZXKJhFxqCZYeY/J7H81s0SHdJwiJ3gFaTUO 99H0qdR0LxYUzzIDrTKKD4nKme5Esp/WaT6dYubBRNP1xcfMVWmKVTrxx80Q/YhgeL NJGmOmUM2rvSBAM7xZsN4GwfGVh1QeeVHfrXAXeM= From: "adhemerval.zanella at linaro dot org" To: glibc-bugs@sourceware.org Subject: [Bug libc/30958] mkstemp always produces the same temp file if it's removed Date: Wed, 11 Oct 2023 16:09:08 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: libc X-Bugzilla-Version: 2.40 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: adhemerval.zanella at linaro dot org X-Bugzilla-Status: RESOLVED X-Bugzilla-Resolution: MOVED X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D30958 --- Comment #10 from Adhemerval Zanella --- > Therefore, if a program like ar always calls mkstemp at start (when not e= ven > a millisecond has passed) then the underlying random infrastructure used = by > mkstemp will yield the same "random" string. >=20 > Parallel execution is solvable by adding something related to each process > like the pid. getpid seems portable and could be added in the implementat= ion > of mkstemp in order to allow for parallel execution without leasking ASLR > info. As I said, a recent gnulib fixed this, now try_tempname_len will always use getrandom (which in turn uses Windows crypt library), which should provide = the required entropy. I am not sure which libc implementation mingw uses, afaik it uses the Windo= ws libmsvcrtXX.a one. So I am not sure whether binutils will use the system o= ne or if they use the gnulib copy from the gnulib/import (which is also outdat= ed, similar to the one from glibc). In fact, this issue seems similar to this one https://bugs.launchpad.net/gcc-arm-embedded/+bug/1848002 --=20 You are receiving this mail because: You are on the CC list for the bug.=