security - sh script vulnerability in Linux -

i given assignment computer security class. we given piece of code analyze , determine vulnerabilities might have.

#!/bin/sh # shell script create copy of shadow file /tmp directory  echo > /tmp/shadowcopy  # allow root access chmod 600 /tmp/shadowcopy  # append original file copy cat /etc/shadow >> /tmp/shadowcopy  # hint: access permissions of file in linux verified when # file opened. process keep original permissions long # keeps file open, if permissions change.  

some classmates , determined script might suffer race condition vulnerability if 2 separate process try open /tmp/shadowcopy.

we think command injection vulnerability possible if /tmp/shadowcopy changed before append begins.

are our assumptions wrong, or code suffer other vulnerabilities might have not considered?

there indeed race condition, in adversary potentially access /tmp/shadowcopy between script creating , script setting permissions. however, if indeed script creates file, initial permissions governed effective umask. if allows files created writable other user that's bad, don't account vulnerability in script itself. script nevertheless address that.

if were case effective umask caused /tmp/shadowcopy writeable others, however, adversary potentially inject fake credentials before permissions changed.

there race condition in if script run @ same time in 2 separate processes, /tmp/shadowcopy end containing arbitrary admixture of 2 copies of /etc/shadow. in not security vulnerability, combine other behavior of larger script create one.

i think you've missed far biggest risk in above code, though. consider because reads /etc/shadow, script must executed root privilege in order perform intended work. now, consider can write in /tmp. now, think of people might able accomplish creating /tmp/shadowcopy before script runs.