linux-kernel - Re: [BUG] Generic syscalls -- chmod vs. fchmodat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201101251529.24779.arnd@arndb.de>
Date:	Tue, 25 Jan 2011 15:29:24 +0100
From:	Arnd Bergmann <arnd@...db.de>
To:	linasvepstas@...il.com
Cc:	Chris Metcalf <cmetcalf@...era.com>,
	GLIBC Devel <libc-alpha@...rceware.org>,
	linux-kernel@...r.kernel.org, libc-ports@...rceware.org,
	linux-api@...r.kernel.org, Roland McGrath <roland@...hat.com>,
	Mike Frysinger <vapier@...too.org>
Subject: Re: [BUG] Generic syscalls -- chmod vs. fchmodat

On Monday 24 January 2011, Linas Vepstas wrote:
> Chris, Arnd, all,

[adding linux-api list]

> Found a bug/incompatibility in the generic syscalls chmod implementation;
> not sure if this is a kernel bug or a glibc bug, or how to correctly resolve it.
> 
> The new "generic chmod" implementation for glibc sends chmod to the
> kernel call sys_fchmodat with  AT_FDCWD, instead of using the older
> "deprecated" chmod syscall.  These two behave slightly differently:  with
> the new implementation, the file "" (i.e. string of length zero) gets
> interpreted
> as . and so the syscall succeeds, setting perms on .  The old syscall would
> return an errno=2 No such file or directory for this filename.
> 
> My gut instinct is that this is a kernel bug, but am not so sure; perhaps this
> is "working as designed".  I thought of submitting a patch to fs/namei.c to
> fix this, but then got lost in the details: there didn't seem to be
> any particularly
> good place to add this check.  Meanwhile, a glibc test case (posix/tst-chmod.c)
> is failing as a result.
> 
> Should we put a check for this funky non-filename into the glibc
> generic code, or into sys_chmodat? Recommendations?

My feeling is that it should be in glibc: as Mike mentioned, we don't normally
change the behavior of existing system calls unless they are obviously
broken to start with. If we want to keep fchmodat getting the implicit
"." directory, and at the same time keep fchmod returning an error, the fchmod
wrapper around fchmodat is the only place that can enforce this.

	Arnd
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/