[PATCH] vfs: fix linkat error for unprivileged AT_EMPTY_PATH

[PATCH] vfs: fix linkat error for unprivileged AT_EMPTY_PATH

[Miklos Szeredi]

From: Miklos Szeredi <mszeredi@suse.cz>

Return proper error value for linkat(..., AT_EMPTY_PATH) without enough
privileges.

I guess ENOENT was used here, because without AT_EMPTY_PATH that's what
we'd return for an empty path.  But it is wrong for AT_EMPTY_PATH, since we
might not even be passing an empty path, we are simply complaining about
lack of privs for which EPERM is the proper error.

Fixes: 11a7b371b64e ("fs: allow AT_EMPTY_PATH in linkat()...")
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org # 2.6.39+
---
 fs/namei.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3957,7 +3957,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
 	 */
 	if (flags & AT_EMPTY_PATH) {
 		if (!capable(CAP_DAC_READ_SEARCH))
-			return -ENOENT;
+			return -EPERM;
 		how = LOOKUP_EMPTY;
 	}
 

Re: [PATCH] vfs: fix linkat error for unprivileged AT_EMPTY_PATH

[Al Viro]

On Wed, Sep 24, 2014 at 05:25:23PM +0200, Miklos Szeredi wrote:
> From: Miklos Szeredi <mszeredi@suse.cz>
> 
> Return proper error value for linkat(..., AT_EMPTY_PATH) without enough
> privileges.
> 
> I guess ENOENT was used here, because without AT_EMPTY_PATH that's what
> we'd return for an empty path.  But it is wrong for AT_EMPTY_PATH, since we
> might not even be passing an empty path, we are simply complaining about
> lack of privs for which EPERM is the proper error.

Umm...  Are you sure that nothing in userland is checking for that
return value?  I agree that EPERM would make more sense, but...

Re: [PATCH] vfs: fix linkat error for unprivileged AT_EMPTY_PATH

[Miklos Szeredi]

On Wed, Sep 24, 2014 at 9:00 PM, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Wed, Sep 24, 2014 at 05:25:23PM +0200, Miklos Szeredi wrote:
>> From: Miklos Szeredi <mszeredi@suse.cz>
>>
>> Return proper error value for linkat(..., AT_EMPTY_PATH) without enough
>> privileges.
>>
>> I guess ENOENT was used here, because without AT_EMPTY_PATH that's what
>> we'd return for an empty path.  But it is wrong for AT_EMPTY_PATH, since we
>> might not even be passing an empty path, we are simply complaining about
>> lack of privs for which EPERM is the proper error.
>
> Umm...  Are you sure that nothing in userland is checking for that
> return value?  I agree that EPERM would make more sense, but...

How could I be sure?

But does it even make sense to check for that error value?  I don't
think it is, since we have never allowed unprivileged AT_EMPTY_PATH
for linkat  (except by bb2314b4799649 which was reverted before being
included in a release).

So if when (if ever) we do allow that, *then* testing for an error
value will make sense.  But surely if one is writing code which can't
even be tested, then it won't come as a big surprise if it will
eventually fail...

Thanks,
Miklos