Re: [PATCH 0/3] vfs: plug some holes involving LAST_BIND symlinks and file bind mounts (try #5)

[Pavel Machek <pavel@ucw.cz>]

On Sun 2009-12-20 21:04:04, Al Viro wrote:
> On Sun, Dec 20, 2009 at 08:59:03PM +0100, Pavel Machek wrote:
> > > WTF not?  It's convenient and doesn't lose any real security.  If your
> > > code relies on inaccessibility of <path> since some component of that
> > > path is inaccessible, you are *already* fscked.  Consider e.g. fchdir()
> > > and its implications - if you have an opened descriptor for parent,
> > > having no exec permissions on grandparent won't stop you at all.  Already.
> > > On all Unices, regardless of openat(), etc.
> > 
> > Consider FD passing over unix socket. Passing R/O file descriptor to
> > the other task, then having the task write to the file is certainly bad.
> 
> You've omitted the "R/O file descriptor of a file that is writable for
> that other task" part...

That is 666 for the other task. But the other task can't access it due
to directory being 700 or something. Your fchdir() argument  does not
apply here.

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html