Re: [RFC/PATCH] revoke/frevoke system calls V2

[Chase Venters <chase.venters@clientec.com>]

On Monday 07 August 2006 17:56, Daniel Jacobowitz wrote:
> On Mon, Aug 07, 2006 at 10:52:59PM +0000, David Wagner wrote:
> > I'm still trying to understand the semantics of this proposed
> > frevoke() implementation.  Can an attacker use this to forcibly
> > close some other processes' file descriptor?  Suppose the target
> > process has fd 0 open and the attacker revokes the file corresponding
> > to fd 0; what is the state of fd 0 in the target process?  Is it
> > closed?  If the target process then open()s another file, does it
> > get bound to fd 0?  (Recall that open() always binds to the lowest
> > unused fd.)  If the answers are "yes", then the security consequences
> > seem very scary.
>
> No, that's already been answered at least once.  The file remains open,
> but returns EBADF on various operations.

IIRC, it returns EBADF because the file actually gets closed. The file 
descriptor, on the other hand, is permanently leaked.

Have these details changed?

Thanks,
Chase