From mboxrd@z Thu Jan  1 00:00:00 1970
From: Pekka Enberg <penberg@cs.helsinki.fi>
Subject: Re: [RFC/PATCH] revoke/frevoke system calls V2
Date: Thu, 27 Jul 2006 21:10:36 +0300
Message-ID: <1154023836.7190.3.camel@ubuntu>
References: <Pine.LNX.4.58.0607271722430.4663@sbz-30.cs.Helsinki.FI>
	 <20060727180634.GA28962@pasky.or.cz>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	akpm@osdl.org, viro@zeniv.linux.org.uk, alan@lxorguk.ukuu.org.uk,
	tytso@mit.edu, tigran@veritas.com
Return-path: <linux-kernel-owner+glk-linux-kernel-3=40m.gmane.org-S1751915AbWG0SKj@vger.kernel.org>
To: Petr Baudis <pasky@suse.cz>
In-Reply-To: <20060727180634.GA28962@pasky.or.cz>
Sender: linux-kernel-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

On Thu, 2006-07-27 at 20:06 +0200, Petr Baudis wrote:
> Make that setuid root or just create log file owned by you and make root
> run it.  Should be innocent enough, right?
> 
> Well, except that you can revoke the log file before the shadow file is
> opened, at which point open() probably reuses the fd and the program
> conveniently logs to /etc/shadow.

No, the fd is leaked on purpose to avoid recycling. See revoke_fds for
details.