linux-kernel - Re: [PATCH] vfs: Pass setxattr(2) flags properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110421030927.GA32145@lst.de>
Date:	Thu, 21 Apr 2011 05:09:27 +0200
From:	Christoph Hellwig <hch@....de>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Jan Kara <jack@...e.cz>, Christoph Hellwig <hch@....de>,
	LKML <linux-kernel@...r.kernel.org>,
	linux-fsdevel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Al Viro <viro@...iv.linux.org.uk>
Subject: Re: [PATCH] vfs: Pass setxattr(2) flags properly

On Wed, Apr 20, 2011 at 04:59:06PM -0700, Linus Torvalds wrote:
> Hmm. This patch looks very sane, but it's been that way - ignoring the
> 'flags' value - since 2009. Does anybody actually _use_ the flags
> field?
> 
> Judging by commit 431547b3c453 (that introduced the thing), it looks
> like a plain mistake, and the previous "flags" was replaced by a "0"
> in the call when it added the "hander->flags" argument at the end. But
> the fact that it's been two years, and nobody noticed, makes me go
> "hmm.."

It's not really used very much.  The only use of XATTR_CREATE is to
prevent creating the attrs used for ACLs from the normal xattrs
interface instead of going through the ACL code, and XATTR_REPLACE
is only used to return -ENOATTR when it's set but the attribute
actually is empty.

The first one could probably be used (by root) to create invalid
attrs that confuse the ACL code, and the second may confuse application
using it, although I doubt there are many.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/