TOCTTOU in File::Path::rmtree() Version 2.12 (continued 2)

• If we are unable to chdir, _rmtree() thinks ...

  • "Oh, so maybe we should try to escalate permissions on this directory to 0777 so we can then chdir into it"

  • ... which is the rationale for the following:

                # (e.g. funny protection mask such as -w- instead of rwx)
                $perm &= oct '7777';
                my $nperm = $perm | oct '700';
                if (
                    !(
                           $arg->{safe}
                        or $nperm == $perm
                        or chmod( $nperm, $root )
                    )
                  )
                {

• The chmod call above is second "Time of Use"

• File::Path's approach to recursive removal is shot through with attempts at escalated permissions