Messages in this thread | | | Date | Wed, 23 Jul 2003 10:00:43 -0700 | From | "David S. Miller" <> | Subject | Re: kernel bug in socketpair() |
| |
On Wed, 23 Jul 2003 12:56:12 -0400 (EDT) Glenn Fowler <gsf@research.att.com> wrote:
> the problem is that linux took an implementation shortcut by symlinking > /dev/fd/N -> /proc/self/fd/N > and by the time the kernel sees /proc/self/fd/N the "self"-ness is apparently > lost, and it is forced to do the security checks
None of this is true. If you open /proc/self/fd/N directly the problem is still there.
> if the /proc fd open code has access to the original /proc/PID/fd/N path > then it can do dup(atoi(N)) when the PID is the current process without > affecting security
If we're talking about the current process, there is no use in using /proc/*/fd/N to open a file descriptor in the first place, you can simply call open(N,...)
I've personally always viewed /proc/*/fd/N as a way to see who has various files or sockets open, ie. a debugging tool, not as a generic way for processes to get access to each other's FDs.
There is an existing mechanism, a portable non-Linux one, that you can use to do that.
Pass the fd over a UNIX domain socket if you want that, truly. That works on every system. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |