O_CREAT|O_DIRECTORY on nonexisting file with ext4 not posix-compliant

O_CREAT|O_DIRECTORY on nonexisting file with ext4 not posix-compliant

[Fiedler Roman]

[-- Attachment #1: Type: text/plain, Size: 1104 bytes --]

Hi,

It seems that the open syscall is not POSIX-compliant when using both
O_CREAT|O_DIRECTORY. This was discussed in [1] with a reference to the POSIX
documentation.

A simple test program is:

#include <fcntl.h>
#include <stdio.h>
#include <sys/stat.h>

int main(int argc, char **argv) {
  int fd;
  struct stat statBuf;
  int result;

  fd=open("xxx", O_RDWR|O_CREAT|O_DIRECTORY, 0600);
  result=fstat(fd, &statBuf);
  if(result) {
    fprintf(stderr, "Stat failed\n");
    return(1);
  }
  fprintf(stderr, "New element type is %d\n", S_ISDIR(statBuf.st_mode));
  return(0);
}


Kind Regards,
Roman

[1] http://www.openwall.com/lists/oss-security/2014/11/26/10


DI Roman Fiedler
Scientist
Digital Safety & Security Department
Assistive Healthcare Information Technology

AIT Austrian Institute of Technology GmbH
Reininghausstraße 13/1 | 8020 Graz | Austria
T +43(0) 50550 2957 | M +43(0) 664 8561599 | F +43(0) 50550 2950
roman.fiedler@ait.ac.at | http://www.ait.ac.at/

FN: 115980 i HG Wien  |  UID: ATU14703506
http://www.ait.ac.at/Email-Disclaimer


[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6344 bytes --]

Re: O_CREAT|O_DIRECTORY on nonexisting file with ext4 not posix-compliant

[NeilBrown]

[-- Attachment #1: Type: text/plain, Size: 1681 bytes --]

On Mon, 15 Dec 2014 17:39:09 +0000 Fiedler Roman <Roman.Fiedler@ait.ac.at>
wrote:

> Hi,
> 
> It seems that the open syscall is not POSIX-compliant when using both
> O_CREAT|O_DIRECTORY. This was discussed in [1] with a reference to the POSIX
> documentation.

Given that O_DIRECTORY is not part of POSIX, I don't think that
POSIX-compliance is an issue here.

However the implementation does seem to differ from the Linux documentation.

I suggest you submit a patch to the manpages project to change

  If  pathname  is  not a directory

to

  If  pathname exists and is  not a directory

That should fix the problem.

NeilBrown


> 
> A simple test program is:
> 
> #include <fcntl.h>
> #include <stdio.h>
> #include <sys/stat.h>
> 
> int main(int argc, char **argv) {
>   int fd;
>   struct stat statBuf;
>   int result;
> 
>   fd=open("xxx", O_RDWR|O_CREAT|O_DIRECTORY, 0600);
>   result=fstat(fd, &statBuf);
>   if(result) {
>     fprintf(stderr, "Stat failed\n");
>     return(1);
>   }
>   fprintf(stderr, "New element type is %d\n", S_ISDIR(statBuf.st_mode));
>   return(0);
> }
> 
> 
> Kind Regards,
> Roman
> 
> [1] http://www.openwall.com/lists/oss-security/2014/11/26/10
> 
> 
> DI Roman Fiedler
> Scientist
> Digital Safety & Security Department
> Assistive Healthcare Information Technology
> 
> AIT Austrian Institute of Technology GmbH
> Reininghausstraße 13/1 | 8020 Graz | Austria
> T +43(0) 50550 2957 | M +43(0) 664 8561599 | F +43(0) 50550 2950
> roman.fiedler@ait.ac.at | http://www.ait.ac.at/
> 
> FN: 115980 i HG Wien  |  UID: ATU14703506
> http://www.ait.ac.at/Email-Disclaimer
> 


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

AW: O_CREAT|O_DIRECTORY on nonexisting file with ext4 not posix-compliant

[Fiedler Roman]

[-- Attachment #1: Type: text/plain, Size: 1290 bytes --]

> Von: NeilBrown [mailto:neilb@suse.de]
>
> On Mon, 15 Dec 2014 17:39:09 +0000 Fiedler Roman
> <Roman.Fiedler@ait.ac.at>
> wrote:
>
> > Hi,
> >
> > It seems that the open syscall is not POSIX-compliant when using both
> > O_CREAT|O_DIRECTORY. This was discussed in [1] with a reference to the
> POSIX
> > documentation.
>
> Given that O_DIRECTORY is not part of POSIX, I don't think that
> POSIX-compliance is an issue here.

That's strange. Shouldn't [1] be the current 2013 standard with O_DIRECTORY 
for open on page 1380? If not, all clear. If yes, does Linux adhere to the 
older version, e.g. 2008 instead?

> However the implementation does seem to differ from the Linux
> documentation.
>
> I suggest you submit a patch to the manpages project to change
>
>   If  pathname  is  not a directory
>
> to
>
>   If  pathname exists and is  not a directory
>
> That should fix the problem.

When [1] is not the standard to be applied, we are done here. If yes, it could 
be decided if the clarifications from [2] (link included in discussion [3] 
from previous message) are already relevant.

> [Snip]


[1] http://cfajohnson.com/pdf/Portable_Operating_System_Interface-POSIX.pdf
[2] http://austingroupbugs.net/view.php?id=847
[3] http://www.openwall.com/lists/oss-security/2014/11/26/10

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 6344 bytes --]

Re: O_CREAT|O_DIRECTORY on nonexisting file with ext4 not posix-compliant

[NeilBrown]

[-- Attachment #1: Type: text/plain, Size: 2869 bytes --]

On Tue, 16 Dec 2014 10:42:30 +0000 Fiedler Roman <Roman.Fiedler@ait.ac.at>
wrote:

> > Von: NeilBrown [mailto:neilb@suse.de]
> >
> > On Mon, 15 Dec 2014 17:39:09 +0000 Fiedler Roman
> > <Roman.Fiedler@ait.ac.at>
> > wrote:
> >
> > > Hi,
> > >
> > > It seems that the open syscall is not POSIX-compliant when using both
> > > O_CREAT|O_DIRECTORY. This was discussed in [1] with a reference to the
> > POSIX
> > > documentation.
> >
> > Given that O_DIRECTORY is not part of POSIX, I don't think that
> > POSIX-compliance is an issue here.
> 
> That's strange. Shouldn't [1] be the current 2013 standard with O_DIRECTORY 
> for open on page 1380? If not, all clear. If yes, does Linux adhere to the 
> older version, e.g. 2008 instead?

I stand corrected.  It is mentioned in POSIX.1-2008.

> 
> > However the implementation does seem to differ from the Linux
> > documentation.
> >
> > I suggest you submit a patch to the manpages project to change
> >
> >   If  pathname  is  not a directory
> >
> > to
> >
> >   If  pathname exists and is  not a directory
> >
> > That should fix the problem.
> 
> When [1] is not the standard to be applied, we are done here. If yes, it could 
> be decided if the clarifications from [2] (link included in discussion [3] 
> from previous message) are already relevant.

My own perspective is that as O_DIRECTORY was first introduced in Linux, the
Linux implementation should be the gold standard.

Neither the Linux man page nor the Posix document are explicit about the
meaning of "O_DIRECTORY|O_CREAT", and both are explicit about the purpose
of O_DIRECTORY being to avoid races and specifically to avoid opening a FIFO
or device-special file - a purpose which carries no implications for
O_DIRECTORY|O_CREAT in the case where the name doesn't exist.

As the documents aren't explicit and the code is, I think the code should win.

It does seem from your second link that Posix may change to make Linux
non-conforming.  This seems totally backwards to me.  I thought Posix was
meant to describe existing practice, not impose upon existing implementations.

So I still think this is a documentation issue.

I guess your first statement stands;

  When [1] is not the standard to be applied, we are done here.

My understanding is that Linux follows Posix when it makes sense to do so
(which it often does).  It isn't clear that it does in this case.

NeilBrown

P.S.  Given that the intended semantics was clearly "Don't open a fifo or
special file', it would have been nice of the flag was O_NO_DEV_FIFO...
Hindsight gives 20/20 vision?


> 
> > [Snip]
> 
> 
> [1] http://cfajohnson.com/pdf/Portable_Operating_System_Interface-POSIX.pdf
> [2] http://austingroupbugs.net/view.php?id=847
> [3] http://www.openwall.com/lists/oss-security/2014/11/26/10


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

Re: O_CREAT|O_DIRECTORY on nonexisting file with ext4 not posix-compliant

[Theodore Ts'o]

On Tue, Dec 16, 2014 at 01:49:26PM +1100, NeilBrown wrote:
> 
> Given that O_DIRECTORY is not part of POSIX, I don't think that
> POSIX-compliance is an issue here.

Actually, it is part of POSIX (the latest IEEE Std 1003.1, 2013 edition):

http://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html

(Things like openat(2) and friends were also added in this revision.)

						- Ted