linux-kernel - Re: [PATCH] vfs: relax linkat() AT_EMPTY_PATH - aka flink()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240413-aufgaben-feigen-e61a1ec3668f@brauner>
Date: Sat, 13 Apr 2024 11:41:57 +0200
From: Christian Brauner <brauner@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Andrew Lutomirski <luto@...nel.org>, Peter Anvin <hpa@...or.com>, 
	Alexander Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>
Subject: Re: [PATCH] vfs: relax linkat() AT_EMPTY_PATH - aka flink() -
 requirements

On Fri, Apr 12, 2024 at 10:43:06AM -0700, Linus Torvalds wrote:
> Side note: I'd really like to relax another unrelated AT_EMPTY_PATH
> issue: we should just allow a NULL path for that case.
> 
> The requirement that you pass an actual empty string is insane. It's
> wrong. And it adds a noticeable amount of expense to this path,
> because just getting the single byte and looking it up is fairly
> expensive.
> 
> This was more noticeable because glibc at one point (still?) did
> 
>         newfstatat(6, "", buf, AT_EMPTY_PATH)
> 
> when it should have just done a simple "fstat()".
> 
> So there were (are?) a *LOT* of AT_EMPTY_PATH users, and they all do a
> pointless "let's copy a string from user space".
> 
> And yes, I know exactly why AT_EMPTY_PATH exists: because POSIX
> traditionally says that a path of "" has to return -ENOENT, not the
> current working directory. So AT_EMPTY_PATH basically says "allow the
> empty path for lookup".
> 
> But while it *allows* the empty path, it does't *force* it, so it
> doesn't mean "avoid the lookup", and we really end up doing a lot of
> extra work just for this case. Just the user string copy is a big deal
> because of the whole overhead of accessing user space, but it's also
> the whole "allocate memory for the path etc".
> 
> If we either said "a NULL path with AT_EMPTY_PATH means empty", or
> even just added a new AT_NULL_PATH thing that means "path has to be
> NULL, and it means the same as AT_EMPTY_PATH with an empty path", we'd
> be able to avoid quite a bit of pointless work.

It also causes issues for sandboxed enviroments (most recently for the
Chrome sandbox) because AT_EMPTY_PATH doesn't actually mean
AT_EMPTY_PATH unless the string is actually empty. Otherwise
AT_EMPTY_PATH is ignored. So I'm all on board for this. I need to think
a bit whether AT_NULL_PATH or just allowing NULL would be nicer. Mostly
because I want to ensure that userspace can easily detect this new
feature.