lkml.org 
[lkml]   [2001]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectWhy side-effects on open(2) are evil. (was Re: [RFD w/info-PATCH] device arguments from lookup)
    	Folks, before you get all excited about cramming side effects into
    open(2), consider the following case:

    1) opening "/dev/zero/start_nuclear_war" has a certain side effect.

    2) Local user does the following:
    ln -sf /dev/zero/start_nuclear_war bar
    while true; do
    mkdir foo
    rmdir foo
    ln -sf bar foo
    rm foo
    done

    3) Comes the night and root runs (from crontab) updatedb(8). Said beast
    includes find(1). With sufficiently bad timing find _will_ be tricked
    into attempt to open foo. It will honestly lstat() it, all right. But
    there's no way to make sure that subsequent open() on the found directory
    will get the same object.

    4) Side effect happens...

    Similar scenarios can be found for other programs run by/as root, but I
    think that the point is obvious - side effects on open() are not a good
    idea. Yes, we can play with checking for O_DIRECTORY, yodda, yodda, but
    I wouldn't bet a dime on security of a system with such side effects.
    A lot of stuff relies on the fact that close(open(foo, O_RDONLY)) is a
    no-op. Breaking that assumption is a Bad Thing(tm).

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 12:53    [W:0.036 / U:0.204 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site