Re: new ...at() flag: AT_NO_JUMPS

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	David Drysdale <drysdale@google.com>
Newsgroups	linux.kernel
Subject	Re: new ...at() flag: AT_NO_JUMPS
Date	Thu, 18 May 2017 11:00:01 +0200
Message-ID	<tIprP-7UI-3@gated-at.bofh.it> (permalink)
References	<tBIIW-3pv-3@gated-at.bofh.it> <tCnsK-3AJ-13@gated-at.bofh.it> <tDzrQ-2sC-15@gated-at.bofh.it>
X-Original-To	Al Viro <viro@zeniv.linux.org.uk>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=eCo3vZy/G8U3lH8UDh4ItuAXsWOd0bHZaM+bKnMDBV0=; b=TfR0fMqVN7DQ53SBshem1HmH4epq7ZxM/ZLXO1AVfiO5jVspkvuiSW6UKfdD/TC7B2 rNgqZgw9DGcL0Gk4LMFwAJSrtT9xiGLNweJaNrDYQu/gNfp6JRaYP9wxkfp4C6BaSfGm gKTieDkBh6vlGZlL/7ffmqtYdyhHTlABnd9VRNRLok4XkJjNcReWAl8AYmutoD/EzqW+ dgCodoctDZ5aZlQHzwRH71seBH5VZWzw54X1OF2JDPECX2OWwoYRkLPT7Eg1U9jLoBwb nyNYHroDAzcR9rM5hn0fGx9x6t4qqDq1XeNp3+c/PuXSbOo0pC4LD+iK3Fz6FuMrfCnl mPrQ==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=eCo3vZy/G8U3lH8UDh4ItuAXsWOd0bHZaM+bKnMDBV0=; b=jw7XfGuDN2YmZMnBrs+9EXhBUTPv02tKujmMT2QUwteAzI+l/sjY/w/lABRHe05+PT TaTo+6N8DVv2ALkvzfUh8LnySvFf4RWcMkzcQnWAAn4GHC0U+3KsfpTaN67AeCskaqE3 JTLr4+DXWxLZkZ5BNL/Wn4SY25gJJW+o+VHnJH81I/w1eDTnp3QDY9NPWiwrIqBKNOfE PcSnQ3gIGeDxD4lhEG9vsNllEbMxx7MkW46XxOIWBBgNW3UXBIr2T4mNZmg5DK4kIJVN 0uiOu/XGbUW1euXe07usYao4KkkHjQj9i2UONQaZx5BNqWT3lTtwrMOGiCuv9OOQhANv ssmg==
X-Gm-Message-State	AODbwcBgKQRhV+25ccTRqegZrqpAH0BYj9rSq8B0gwIfGdkzALG5D+Qj yvUahSiqX4ZMUKF7ox1RUvr7/KqE5/1G
X-Received	by 10.28.11.200 with SMTP id 191mr2071423wml.89.1495097424401; Thu, 18 May 2017 01:50:24 -0700 (PDT)
MIME-Version	1.0
Content-Type	text/plain; charset="UTF-8"
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	26
Organization	linux.* mail to news gateway
X-Original-Cc	Jann Horn <jannh@google.com>, Linux API <linux-api@vger.kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Linux FS Devel <linux-fsdevel@vger.kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>
X-Original-Date	Thu, 18 May 2017 09:50:03 +0100
X-Original-Message-ID	<CAHse=S9=Qpjcex+1O0n1r_pnyLZPUq+K03thbAozG61umEH9Ug@mail.gmail.com>
X-Original-References	<20170429220414.GT29622@ZenIV.linux.org.uk> <CAG48ez0wccvQ5i+XN_Q_yA9_ZwSaGb-W+zky0KQb_GU=9G+MSw@mail.gmail.com> <20170505003030.GM29622@ZenIV.linux.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1643984

Show key headers only | View raw

On Fri, May 5, 2017 at 1:30 AM, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Mon, May 01, 2017 at 07:36:52PM +0200, Jann Horn wrote:
>
>> Oh, nice!
>>
>> It looks like this is somewhat similar to the old O_BENEATH proposal,
>> but because the intentions behind the proposals are different
>> (application sandboxing versus permitting an application to restrict its
>> own filesystem accesses), the semantics differ: AT_NO_JUMPS
>> doesn't prevent starting the path with "/", but does prevent mountpoint
>> traversal. Is that correct?
>
> It prevents both, actually - I missed that in description, but this
>         if (unlikely(nd->flags & LOOKUP_NO_JUMPS))
>                 return -ELOOP;
> in nd_jump_root() affects absolute pathnames same way as it affects
> absolute symlinks.
>
> It's not quite O_BENEATH, and IMO it's saner that way - a/b/c/../d is
> bloody well allowed, and so are relative symlinks that do not lead out of
> the subtree.  If somebody has a good argument in favour of flat-out
> ban on .. (_other_ than "other guys do it that way, and it doesn't need
> to make sense 'cuz security!!1!!!", please), I'd be glad to hear it.

BTW, FreeBSD head now allows .. if it stays in subtree:
https://svnweb.freebsd.org/base?view=revision&revision=308212

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: new ...at() flag: AT_NO_JUMPS David Drysdale <drysdale@google.com> - 2017-05-18 11:00 +0200

csiph-web