Re: symlinks with permissions

[Pavel Machek <pavel@ucw.cz>]

Hi!

> > Basically, that follow link should behave as dup(), not as open().
> 
> There are reasons why an open is an open here.  I don't remember the
> details but I found the archive of that conversation once.  Maybe it was
> just technical limitations of the time.

That would be really really useful to bring 

> >> I certainly am not interested in debugging or maintaining the stacking
> >> inode code that would be necessary to close this theoretical corner
> >> case.  There are much more real bugs that need attention.
> >
> > But if we can get trivial 10-liner, that should be acceptable, right?
> 
> How many linux shell scripts and other applications that use /dev/fd/N
> or /proc/self/fd/N will you be breaking?

Zero. (Well unless someone is exploiting it in wild).

> Closing a theoretical security hole at the expense of breaking real
> applications is a show stopper.

I don't plan to remove /proc/*/fd; but I would like it to behave like
dup().

(I still hope some security team does work for me :-).
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html