On Fri, 3 Mar 2017 12:14:10 -0600 Eric Blake <ebl...@redhat.com> wrote:
> On 03/03/2017 11:25 AM, Greg Kurz wrote: > > We should pass O_NOFOLLOW otherwise openat() will follow symlinks and make > > QEMU vulnerable. > > > > O_PATH was used as an optimization: the fd returned by openat_dir() is only > > passed to openat() actually, so we don't really need to reach the underlying > > filesystem. > > > > O_NOFOLLOW | O_PATH isn't an option: if name is a symlink, openat() will > > return a fd, forcing us to do some other syscall to detect we have a > > symlink. Also, O_PATH doesn't exist in glibc 2.13 and older. > > But the very next use of openat(fd, ) should fail with EBADF if fd is > not a directory, so you don't need any extra syscalls. I agree that we > _need_ O_NOFOLLOW, but I'm not yet convinced that we must avoid O_PATH > where it works. > You may have a point indeed. > I'm in the middle of writing a test program to probe kernel behavior and > demonstrate (at least to myself) whether there are scenarios where > O_PATH makes it possible to open something where omitting it did not, > while at the same time validating that O_NOFOLLOW doesn't cause problems > if a symlink-fd is returned instead of a directory fd, based on our > subsequent use of that fd in a *at call. > I must leave right now, but please share the result of your experiment. Thanks for your support on helping to fix 9p, Eric :) Cheers. -- Greg
pgpA175fXhata.pgp
Description: OpenPGP digital signature
