linux-kernel - Re: [PATCH] vfs: relax linkat() AT_EMPTY_PATH - aka flink()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wjTm-WVoQNnG933Nc3xfup-XrLWJ2d+Y4c-f-3b6ya3rQ@mail.gmail.com>
Date: Thu, 11 Apr 2024 13:22:26 -0700
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Charles Mirabile <cmirabil@...hat.com>
Cc: Christian Brauner <brauner@...nel.org>, Alexander Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Andrew Lutomirski <luto@...nel.org>, Peter Anvin <hpa@...or.com>
Subject: Re: [PATCH] vfs: relax linkat() AT_EMPTY_PATH - aka flink() - requirements

On Thu, 11 Apr 2024 at 13:08, Charles Mirabile <cmirabil@...hat.com> wrote:
>
> The problem with this is that another process might be able to access
> the file during via that name during the brief period before it is
> unlinked. If I am not using NFS, I am always going to prefer using
> O_TMPFILE. I would rather be able to do that without restriction even
> if it isn't the most robust solution by your definition.


Oh, absolutely. I think the right pattern is basically some variation of

    fd = open(filename, O_TMPFILE | O_WRONLY, 0600);
    if (fd < 0) {
        char template{...] = ".tmpfileXXXXXX";
        fd = mkstmp(template);
        unlink(template);
    }
    .. now act on fd to initialize it ..
    linkat(fd, "", AT_FDCWD, "finalname", AT_EMPTY_PATH);

which should work reasonably well in various environments.

Clearly O_TMPFILE is the superior option when it exists. I'm just
saying that anything that *relies* on it existing is dubious.

              Linus