News for hackers. Stuff that matters.

A comment on HardCIDR will query ARIN and a pool of BGP route servers. Parent comment

Re:HardCIDR will query ARIN and a pool of BGP route servers by CJefferson on Saturday March 18, 2017 @11:00AM (#13901536)
I wish modern OSes made this easier. I would love to have an easy bullrtproof way of saying "give me a temp directory for writing, don't let me write anywhere else, clean up my directory after me".
[ Parent | on HN ]
Re:HardCIDR will query ARIN and a pool of BGP route servers by cheeseprocedure on Saturday March 18, 2017 @11:30AM (#13901668)
Chances are that every system this script runs on has "mktemp," and trapping exit makes it easy to clean up when things are finished.

https://www.mktemp.org/manual.html

http://redsymbol.net/articles/bash-exit-traps/

[ Parent | on HN ]
Re:HardCIDR will query ARIN and a pool of BGP route servers by peterwwillis on Saturday March 18, 2017 @11:54AM (#13901810)
Yep, makes it much simpler to write scripts like this https://github.com/psypete/public-bin/blob/public-bin/src/st... (run an application that's stored in git, but in a temp working directory, and clean up after)
[ Parent | on HN ]
Re:HardCIDR will query ARIN and a pool of BGP route servers by CJefferson on Saturday March 18, 2017 @06:03PM (#13903748)
But, how can I make super sure some combination of my mistakes, undefined variables, failed cd commands, race conditions, etc, can't lead to me clearing the wrong directory.

I'm sure this is excessive paranoia, but I have never been confident to release a script that classes a directory, I'm to worked about things like subtle differences in how mktemp works on linux and mac for example.

[ Parent | on HN ]
Re:HardCIDR will query ARIN and a pool of BGP route servers by stuuuuuuuuu on Saturday March 18, 2017 @01:06PM (#13902247)
A good usecase for Docker, maybe? Put the script in a container and let it run wild, then delete the container when it's done.
[ Parent | on HN ]
Re:HardCIDR will query ARIN and a pool of BGP route servers by the8472 on Saturday March 18, 2017 @12:23PM (#13901981)
on linux the following might work:

    - enter a user and mount namespace
    - mount a tmpfs, e.g. over /tmp
    - remount everything else as readonly
alternatively

    firejail --overlay-tmpfs <command>
[ Parent | on HN ]