[lkml]   [2003]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] new syscall: flink
    On Mon, Apr 07, 2003 at 10:09:15AM +0100, Malcolm Beattie wrote:
    > Here's another example along similar lines: you can open a file
    > O_APPEND and pass the descriptor along to another process (e.g. a
    > security mediator process that hands out a file descriptor to a
    > less-trusted recipient that it can use for appending entries only).
    > fcntl() explicity prevents the clearing of the O_APPEND flag on a
    > file which was opened with O_APPEND. With flink, one could flink()
    > and re-open without O_APPEND: security hole.

    That would be a big security hole waiting to happen though. Nothing
    forces the less trusted recipient not to send in zeroes or finish the
    lines (for a text file) or respect a particular format (for a binary

    In practice, I tend to think that any secutiry scheme flink breaks is
    brittle at best. It requires passing a fd to a file which is owned by
    the same uid than the untrusted process, and rely somehow on the
    directory structure to prevent direct access to said file. But the
    trusted process must have had access to the file somehow, so, well,
    it's really, really brittle.

    /proc breaking it already isn't very surprising.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:34    [W:0.018 / U:4.336 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site