Software: Apache/2.0.54 (Fedora). PHP/5.0.4 

uname -a: Linux mina-info.me 2.6.17-1.2142_FC4smp #1 SMP Tue Jul 11 22:57:02 EDT 2006 i686 

uid=48(apache) gid=48(apache) groups=48(apache)
context=system_u:system_r:httpd_sys_script_t 

Safe-mode: OFF (not secure)

/usr/share/doc/gamin-0.1.1/   drwxr-xr-x
Free 3.78 GB of 27.03 GB (13.97%)
                            Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    

Viewing file:     socket.txt (1.59 KB)      -rw-r--r--

If there is abstract socket support:
====================================

  use them as "\0/tmp/fam-$USER-$GAM_CLIENT_ID"
  They are not mapped on the filesystem, no attack is possible that way.
  The client and the server checks on the first '\0' byte received that
  the other side is of the same UID

If there is no abstract socket support:
=======================================

Server side:
------------

start:
  try to create /tmp/fam-$USER using mkdir('/tmp/fam-$USER', 007)
  if error:
      make a stat() on it
      if doesn't exist:
          return failure to create
      if user is not getuid() or mode is not 007 or type is not dir:
          try to unlink()
	  if error:
	      exit with error.
	  if success:
	      goto start:
 
  do the socket()/bind() on /tmp/fam-$USER/fam-$GAM_CLIENT_ID
  
Client side:
------------

  make a stat on /tmp/fam-$USER
  if doesn't exist:
      return failure to create should start the server
  if user is not getuid() or mode is not 007 or type is not dir:
      try to unlink()
      if error:
          exit with error.
      if success:
          return failure should start the server
  make a stat on /tmp/fam-$USER/fam-$GAM_CLIENT_ID
  if doesn't exist:
      return failure to create should start the server
  if user is not getuid() or type is not socket:
      try to unlink()
      if error:
          exit with error.
      if success:
          return failure should start the server

  do the socket()/connect() on /tmp/fam-$USER/fam-$GAM_CLIENT_ID

  The client and the server checks on the first '\0' byte received that
  the other side is of the same UID.