Hi Shu-Chun,

On 1/12/23 04:21, Shu-Chun Weng wrote:
Commit b8002058 strengthened openat()'s /proc detection by calling
realpath(3) on the given path, which allows various paths and symlinks
that points to the /proc file system to be intercepted correctly.

Using realpath(3), though, has a side effect that it reads the symlinks
along the way, and thus changes their atime. The results in the
following code snippet already get ~now instead of the real atime:

   int fd = open("/path/to/a/symlink", O_PATH | O_NOFOLLOW);
   struct stat st;
   fstat(fd, st);
   return st.st_atime;

This change opens a path that doesn't appear to be part of /proc
directly and checks the destination of /proc/self/fd/n to determine if
it actually refers to a file in /proc.

Neither this nor the existing code works with symlinks or indirect paths
(e.g.  /tmp/../proc/self/exe) that points to /proc/self/exe because it
is itself a symlink, and both realpath(3) and /proc/self/fd/n will
resolve into the location of QEMU.

Does this fix any of the following issues?
https://gitlab.com/qemu-project/qemu/-/issues/829
https://gitlab.com/qemu-project/qemu/-/issues/927
https://gitlab.com/qemu-project/qemu/-/issues/2004

Signed-off-by: Shu-Chun Weng <s...@google.com>
---
  linux-user/syscall.c | 42 +++++++++++++++++++++++++++++++++---------
  1 file changed, 33 insertions(+), 9 deletions(-)


Reply via email to