Posted by halfdog on Jun 24
For those, who did not already know:
Due to specification, apache follows symlinks even when -FollowSymLinks
is set, when the data is modified concurrently. This can be trivially
shown as demonstrated in
http://www.halfdog.net/Security/2011/ApacheNoFollowSymlinkTimerace/ .
When performing host hardening, do not think, the -FollowSymLinks option
alone will prevent you from symlink attacks.
Source: FYI: Apache httpd NoFollowSymLink follows symlinks feature
