linux-kernel - Re: [PATCH v2 1/3] namei: implement O_BENEATH-style AT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181027075348.GN32577@ZenIV.linux.org.uk>
Date:   Sat, 27 Oct 2018 08:53:49 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Aleksa Sarai <cyphar@...har.com>
Cc:     Ed Maste <emaste@...ebsd.org>,
        David Drysdale <drysdale@...gle.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/3] namei: implement O_BENEATH-style AT_* flags

On Sat, Oct 27, 2018 at 06:17:29PM +1100, Aleksa Sarai wrote:

> I'm going to send out a v4 "soon" but I would like to know what folks
> think about having resolveat(2) (or similar) to separate the scoping O_*
> flags and produce an O_PATH -- since unsupported O_* flags are ignored
> by older kernels userspace will have to do some plenty of checking after
> each path operation.
> 
> Personally, I believe this (along with AT_EMPTY_PATH for openat(2))
> would help with some other O_PATH issues.

The trouble with resolveat(2) is that for anything directory-modifying
you really want directory locked before the lookup for last component.
IOW, funlink(2) et.al. are hopeless.  You can, of course, do O_PATH
open for everything sans the last component, and do unlinkat() with
the base being the result of that open and the last component for
relative pathname, but that takes more work on the userland side than
you probably want to bother with.

IOW, pathname resolution for directory entry is seriously different from
that for fs object.  And you obviously don't want to return from a syscall
with directory locked.