From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH v12 11/12] open: openat2(2) syscall Date: Sat, 7 Sep 2019 11:15:09 -0700 Message-ID: References: <20190904201933.10736-1-cyphar@cyphar.com> <20190904201933.10736-12-cyphar@cyphar.com> <7236f382d72130f2afbbe8940e72cc67e5c6dce0.camel@kernel.org> Mime-Version: 1.0 (1.0) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Linus Torvalds Cc: Jeff Layton , Aleksa Sarai , Al Viro , "J. Bruce Fields" , Arnd Bergmann , David Howells , Shuah Khan , Shuah Khan , Ingo Molnar , Peter Zijlstra , Christian Brauner , Eric Biederman , Andy Lutomirski , Andrew Morton , Alexei Starovoitov , Kees Cook , Jann Horn , Tycho Andersen , David Drysdale , Chanho Min , Oleg Nesterov List-Id: linux-api@vger.kernel.org > On Sep 7, 2019, at 10:45 AM, Linus Torvalds wrote: >=20 >> On Sat, Sep 7, 2019 at 10:42 AM Andy Lutomirski wro= te: >>=20 >> Linus, you rejected resolveat() because you wanted a *nice* API >=20 > No. I rejected resoveat() because it was a completely broken garbage > API that couldn't do even basic stuff right (like O_CREAT). >=20 > We have a ton of flag space in the new openat2() model, we might as > well leave the old flags alone that people are (a) used to and (b) we > have code to support _anyway_. >=20 > Making up a new flag namespace is only going to cause us - and users - > more work, and more confusion. For no actual advantage. It's not going > to be "cleaner". It's just going to be worse. >=20 >=20 If we keep all the flag bits in the same mask with the same values, then we=E2= =80=99re stuck with O_RDONLY=3D0 and everything that implies. We=E2=80=99ll= have UPGRADE_READ that works differently from the missing plain-old-READ bi= t, and we can=E2=80=99t express execute-only-no-read-or-write. This sucks. Can we at least split the permission bits into their own mask and make bits 0= and 1 illegal in the main set of flags in openat2? There=E2=80=99s another thread going on right now about adding a bit along t= he lines of =E2=80=9CMAYEXEC=E2=80=9D, and one of the conclusions was that i= t should wait for openat2 so that it can have same semantics. If we=E2=80=99= re stuck with O_RDONLY and friends, then MAYEXEC is doomed to being at least= a bit nonsensical. As an analogy, AMD64 introduced bigger PTEs but kept the same nonsense encod= ing of read and write permission. And then we got NX, and now we=E2=80=99re g= etting little holes in the encoding stolen by CET to mean new silly things. = I don=E2=80=99t know if you=E2=80=99ve been following the various rounds of= patches, but it is truly horrible. The mapping from meaning to the actual b= its is *shit*, and AMD64 should have made a clean break instead. open()=E2=80=99s permission bits are basically the same situation. And the k= ernel *already* has a non-type-safe translation layer. Please, please let op= enat2() at least get rid of the turd in open()=E2=80=99s bits 0 and 1.