[Bug libstdc++/104161] Potential Security Vulnerability: remove_all and symbolic link

[jistone at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104161

Josh Stone <jistone at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jistone at redhat dot com

--- Comment #5 from Josh Stone <jistone at redhat dot com> ---
You also need to use openat, because O_NOFOLLOW only affects the *trailing*
component of the path. That is, if we're removing "/base" and you're down to
"/base/foo/bar", I could change "/base/foo" to a symlink and then you'll open
"/other/bar".