linux-kernel - Re: [PATCH 2/2] fs: reject unknown open flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Mar 2017 10:03:24 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Christoph Hellwig <hch@....de>
Cc:     Alexander Viro <viro@...iv.linux.org.uk>,
        Linux API <linux-api@...r.kernel.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        libc-alpha <libc-alpha@...rceware.org>
Subject: Re: [PATCH 2/2] fs: reject unknown open flags

On Thu, Mar 30, 2017 at 9:33 AM, Christoph Hellwig <hch@....de> wrote:
> This way userspace can probe for actually supported flags.

No. Not this way.

First off, since we've never checked the flags, it really is likely
that somebody just by mistake passes in garbage.

So it might cause a regression, which means we might need to revert
it, which in turn means that we sure as hell do *not* want to
encourage _other_ people to then use this to "probe" the accepted
flags.

Secondly, since we know old kernels don't test the flags, it is
*doubly* stupid to then talk about "probing accepted flags".

So the whole concept of probing is pure and utter f*cking garbage.

So get that idiotic idea out of your head.

What might be acceptable is to say "we should have not accepted random
flags to begin with", and add this error case, but realize that
probing for those flags is completely idiotic and moronic.

Once you do that, you can then say "to make it easier to see if
somebody might have passed in garbage that just happened to work, we
can add a WARN_ON_ONCE()" for this case. That has the added advantage
that it hopefully makes people understand just how stipid that idiotic
"probe flags" idea was.

Anyway, big NAK on this idiotic patch series, since as is the whole
concept and reasoning for it is crazy crap.

People, you need to really understand and INTERNALIZE that backwards
compatibility is important.

You need to understand it so well that you go "wow, this whole idea
about probing was obviously shit".

Really.

                  Linus