[lkml]   [2017]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] vfs: hard-ban creating files with control characters in the name
On Tue, Oct 03, 2017 at 03:07:24AM +0100, Al Viro wrote:
> That essay is full of shit, and you've even mentioned parts of that just above...
> NAK; you'd _still_ need proper quoting (or a shell with something resembling an
> actual syntax, rather than the "more or less what srb had ended up implementing"),
> so it doesn't really buy you anything. Badly written script will still be
> exploitable. And since older kernels and other Unices are not going away,
> you would've created an inconsistently vulnerable set of scripts, on top of
> the false sense of security.

Banning certain characters is certainly not a panacea, and there are a
lot of best practices that you have to follow when writing good
scripts which most people don't follow, and so it's arguable that
benefits are being overstated.

That being said the costs of suppressing certain bytes from appearing
in pathnames seem fairly low. Would this be more palatable if the ban
on control characters were made into a compile-time or mount-time

- Ted

 \ /
  Last update: 2017-10-03 18:40    [W:0.047 / U:3.948 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site