From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753495AbcDZTZV (ORCPT ); Tue, 26 Apr 2016 15:25:21 -0400 Received: from outbound.smtp.vt.edu ([198.82.183.121]:49211 "EHLO omr2.cc.vt.edu" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753072AbcDZTZS (ORCPT ); Tue, 26 Apr 2016 15:25:18 -0400 X-Mailer: exmh version 2.8.0 04/21/2012 with nmh-1.6+dev To: Al Viro Cc: Linus Torvalds , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [RFC] a corner case of open(2) From: Valdis.Kletnieks@vt.edu In-Reply-To: <20160426190248.GQ25498@ZenIV.linux.org.uk> References: <20160426175538.GO25498@ZenIV.linux.org.uk> <89187.1461696097@turing-police.cc.vt.edu> <20160426190248.GQ25498@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="==_Exmh_1461698716_3054P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit Date: Tue, 26 Apr 2016 15:25:16 -0400 Message-ID: <92598.1461698716@turing-police.cc.vt.edu> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --==_Exmh_1461698716_3054P Content-Type: text/plain; charset=us-ascii On Tue, 26 Apr 2016 20:02:48 +0100, Al Viro said: > > The biggest danger I can see is some shell script doing something like: > > > > foobar > $dir/$targetfile > > > > and $targetfile is unset. If we allow a program to get an open fd that refers > > to a directory, what are the semantics of various operations on that fd? > > Huh? We certainly do allow to get an open fd that refers to a directory - > how else could ls(1) possibly work? See getdents(2) - it does use an > open file descriptor to specify the directory we operate upon. Gaah.. I lost a few words in there - /bin/ls is *expecting* to operate on a directory, so to calls getdents. I meant some generic program that opened a directory in error, and was expecting to act on "stream of bytes" > We also do not allow opening directories for *write*, and in that case EISDIR > is the right error (and we do return it). OK, that and ftruncate() are about the only ways to cause trouble with a directory opened by accident... --==_Exmh_1461698716_3054P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Exmh version 2.5 07/13/2001 iQIVAwUBVx/AnAdmEQWDXROgAQItNw//X82rAQe3n3iLAU1/b50PvzATlY6GCYYR A6eP9cI56Ompf3Y0W2Y//+XGuHKHfwXysIOJFXNkHb7fxy2TJwZwG+ZmBE392wE2 qk7azleds7TaQ6fLVkR/4xOxK9hGjtk3ZVmeVjYrfs+GBdpRdSOkWXcNsNcXhXZM 1JDbiMephCeVUxbwY/pX6xFJfkBM8q58li8+Bcl2Xo5gPSrLO8Epmhl/nHNilw2W 2dJMf9t0HNkggD5jeKLHzhMF9u840t1hThnhfg49V0NP1bQzu2BmlgiAqX8qwNV8 5bk2tB34CVMMV343+yZf8utC5WNwiuMhyvlDbyQi7uaGki/rjr8KN4bzoX2HRZ76 FcKXc8TL+rFrIyk526SVyAG90y2foIMp7hCGxjVqfn/yKkeP+BhplUN6Q3od8vHM JLSymjQ6jHhNm/kH1YIDoqB1hrw5Skuh8YgF7+m0nkXDDCrkJw53kFBQeOyKS33j XOORqsl8pZjjZktI0EUGvdHcZrI4L/KFPQJ/BgEMHtE8Jp1bb1TW3ko495O9yLtZ ZOKSJ2b5Lz8M5ujZkFRbDQdPkWo7NI8/z4Bekl+PZeXMVNjidLyXlJ3pNVLElkfe cGRFjqWcT9aya8dsDpkCQlx/YSpCFmpZxPPnGJxvXIhfB5YcJgNl1gA1Qxig2mhh Ic8MN3mNlAg= =FIv/ -----END PGP SIGNATURE----- --==_Exmh_1461698716_3054P--