linux-kernel - RFC: reject unknown open flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170330163327.23920-1-hch@lst.de>
Date:   Thu, 30 Mar 2017 18:33:25 +0200
From:   Christoph Hellwig <hch@....de>
To:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Alexander Viro <viro@...iv.linux.org.uk>
Cc:     linux-api@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, libc-alpha@...rceware.org
Subject: RFC: reject unknown open flags

Linux has traditionally accepted random garbage in the flags argument to
the open syscall (including the later added openat).  This really harms
when adding new flags, because applications can't just probe for the
flag to actually work.  While rejecting unknown flags is an ABI change
strictly speaking I can't see what would actually get broken by it
in practice, so by the Linux rules it might not be an issue.

Below is the trivial series to reject unknown flags.  If this is not
acceptable there migh be some other ways, although they seem ugly:

 (a) add a new openat2 system call that enforces this behavior, and
     hope all majors libcs switch to using that by default to implement
     open(3).
 (b) add a new personality flag to enforce this behavior (or maybe
     opt in by default and allow admins to opt out of it)