Messages in this thread | | | Subject | Re: [PATCH] vfs: new O_NODE open flag | From | Miklos Szeredi <> | Date | Mon, 28 Sep 2009 18:04:10 +0200 |
| |
On Mon, 28 Sep 2009, Andreas Dilger wrote: > On Sep 28, 2009 12:25 +0200, Miklos Szeredi wrote: > > BTW I just checked, and it is possible to re-open or promote an fd > > opened with O_NODE like this: > > > > char tmp[64]; > > > > fd = open(filename, O_NODE | O_NOACCESS); > > /* ... */ > > sprintf(tmp, "/proc/self/fd/%i", fd); > > fd_rw = open(tmp, O_RDWR); > > > > Now fd_rw is guaranteed to refer to the same inode as fd. > > It seems very unpleasant to require applications using O_NODE to > reopen files using /proc.
The point of the above example was that reopening a file descriptor with upgraded (or downgraded) access mode is even now possible. Which either means:
a) the current permission model under /proc/PID/fd has a security hole (which Jamie is worried about)
b) we can safely implement this with by changing openat() semantics, or even with a new reopen() syscall
I'm not too worried about the security aspect of this, but it's something to keep in mind.
Thanks, Miklos
| |