linux-kernel - Re: Have RESOLVE_* flags superseded AT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 1 Mar 2020 17:46:34 +0100
From:   Christian Brauner <christian.brauner@...ntu.com>
To:     Aleksa Sarai <cyphar@...har.com>
Cc:     David Howells <dhowells@...hat.com>, linux-api@...r.kernel.org,
        viro@...iv.linux.org.uk, metze@...ba.org,
        torvalds@...ux-foundation.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, fweimer@...hat.com
Subject: Re: Have RESOLVE_* flags superseded AT_* flags for new syscalls?

On Sun, Mar 01, 2020 at 02:54:11AM +1100, Aleksa Sarai wrote:
> On 2020-03-01, Aleksa Sarai <cyphar@...har.com> wrote:
> > On 2020-02-28, Christian Brauner <christian.brauner@...ntu.com> wrote:
> > > So we either end up adding new AT_* flags mirroring the new RESOLVE_*
> > > flags or we end up adding new RESOLVE_* flags mirroring parts of AT_*
> > > flags. And if that's a possibility I vote for RESOLVE_* flags going
> > > forward. The have better naming too imho.
> > 
> > I can see the argument for merging AT_ flags into RESOLVE_ flags (fewer
> > flag arguments for syscalls is usually a good thing) ... but I don't
> > really like it. There are a couple of problems right off the bat:
> > 
> >  * The prefix RESOLVE_ implies that the flag is specifically about path
> >    resolution. While you could argue that AT_EMPTY_PATH is at least
> >    *related* to path resolution, flags like AT_REMOVEDIR and
> >    AT_RECURSIVE aren't.
> > 
> >  * That point touches on something I see as a more fundamental problem
> >    in the AT_ flags -- they were intended to be generic flags for all of
> >    the ...at(2) syscalls. But then AT_ grew things like AT_STATX_ and
> >    AT_REMOVEDIR (both of which are necessary features to have for their
> >    respective syscalls, but now those flag bits are dead for other
> >    syscalls -- not to mention the whole AT_SYMLINK_{NO,}FOLLOW thing).
> > 
> >  * While the above might be seen as minor quibbles, the really big
> >    issue is that even the flags which are "similar" (AT_SYMLINK_NOFOLLOW
> >    and RESOLVE_NO_SYMLINKS) have different semantics (by design -- in my
> >    view, AT_SYMLINK_{NO,}FOLLOW / O_NOFOLLOW / lstat(2) has always had
> >    the wrong semantics if the intention was to be a way to safely avoid
> >    resolving symlinks).
> > 
> > But maybe I'm just overthinking what a merge of AT_ and RESOLVE_ would
> > look like -- would it on.
> 
> Eugh, dropped the rest of that sentence:
> 
> ... would it only be the few AT_ flags which are strictly related to
> path resolution (such as AT_EMPTY_PATH)? If so wouldn't that just mean
> we end up with two flag arguments for new syscalls?

That's a good question that we kinda ran into right once we
accepted the RESOLVE_* namespace implicitly? This smells like the same
problem we have in e.g. waitid() with WEXITED/WSTOPPED/WCONTINUED and
WNOHANG/WNOWAIT...I think one answer could be one flag argument,
different prefixes? i.e. RESOLVE_* and then e.g. simply REMOVE_DIR instead of
AT_REMOVEDIR. This way we don't duplicate the problem the AT_*
namespace had (e.g. AT_REMOVEDIR and AT_SYMLINK_NOFOLLOW being about two
separate things). Maybe that's crazy and doesn't really make things
better?

Christian