From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rich Felker Subject: Re: [PATCHv10 man-pages 5/5] execveat.2: initial man page for execveat(2) Date: Fri, 9 Jan 2015 16:31:18 -0500 Message-ID: <20150109213118.GV4574@brightrain.aerifal.cx> References: <1416830039-21952-1-git-send-email-drysdale@google.com> <1416830039-21952-6-git-send-email-drysdale@google.com> <54AFF813.7050604@gmail.com> <20150109161302.GQ4574@brightrain.aerifal.cx> <20150109204815.GR4574@brightrain.aerifal.cx> <20150109205626.GK22149@ZenIV.linux.org.uk> <20150109205926.GT4574@brightrain.aerifal.cx> <877fwvy7ln.fsf@x220.int.ebiederm.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <877fwvy7ln.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: "Eric W. Biederman" Cc: Al Viro , David Drysdale , "Michael Kerrisk (man-pages)" , Andy Lutomirski , Meredydd Luff , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Andrew Morton , David Miller , Thomas Gleixner , Stephen Rothwell , Oleg Nesterov , Ingo Molnar , "H. Peter Anvin" , Kees Cook , Arnd Bergmann , Christoph Hellwig , X86 ML , linux-arch , Linux API , sparclinux-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-api@vger.kernel.org On Fri, Jan 09, 2015 at 03:20:04PM -0600, Eric W. Biederman wrote: > Rich Felker writes: > > > On Fri, Jan 09, 2015 at 08:56:26PM +0000, Al Viro wrote: > >> On Fri, Jan 09, 2015 at 03:48:15PM -0500, Rich Felker wrote: > >> > I think this is a case that needs to be fixed, though it's hard. The > >> > normal correct usage for fexecve is to always pass an O_CLOEXEC file > >> > descriptor, and the caller can't really be expected to know whether > >> > the file is a script or not. We discussed workarounds before and one > >> > idea I proposed was having fexecve provide a "one open only" magic > >> > symlink in /proc/self/ to pass to the interpreter. It would behave > >> > like an O_PATH file descriptor magic symlink in /proc/self/fd, but > >> > would automatically cease to exist on the first open (at which point > >> > the interpreter would have a real O_RDONLY file descriptor for the > >> > underlying file). > >> > >> For fsck sake, folks, if you have bloody /proc, you don't need that shite > >> at all! Just do execve on /proc/self/fd/n, and be done with that. > >> > >> The sole excuse for merging that thing in the first place had been > >> "would anybody think of children^Wsclerotic^Whardened environments > >> where they have no /proc at all". > > > > That doesn't work. With O_CLOEXEC, /proc/self/fd/n is already gone at > > the time the interpreter runs, whether you're using fexecveat or > > execve with "/proc/self/fd/n" to implement POSIX fexecve(). That's the > > problem. This breaks the intended idiom for fexecve. > > O_CLOEXEC with a #! intepreter can not work. If the file descriptor is > closed a #! interpreter can not open it. So I don't know why or how > you want that to work but it is nonsense. The why is simple: fexecve always expects a close-on-exec file descriptor. Otherwise the program being executed would need to take a special option telling it to close the spurious fd it inherits. Most programs don't have such an option, and there's no way to do it without application-specific knowledge. The how is difficult, but it can be done. Rich