Re: [PATCH] new syscall: flink

David Wagner
2003-04-07T02:43:41Z

H. Peter Anvin wrote:
>Alan Cox wrote:
>> Suppose I give you an O_RDONLY handle to a file which you then
>> flink and gain write access too ?
>
>This, I believe, is the real issue. However, we already have that
>problem:

No, I don't think we already have that problem. I think flink()
would introduce a new security hole not already present.

> rfd = open("testfile", O_RDONLY|O_CREAT, 0666);
> /* Now rfd is a read-only file descriptor */
>
> sprintf(filebuf, "/proc/self/fd/%d", rfd);
> wfd = open(filebuf, O_RDWR);

I don't think this is the same. With /proc/self/fd, I can't escalate
privileges on a read-only fd. You did the wrong test, because the user
already has write access to "testfile". Change the above to make rfd a
read-only file descriptor to a file that I don't have write permission to,
and you'll find that the test all of a sudden fails. (For instance, add
a chmod("testfile", 0444); between the two open()s, and see what happens.)

I think /proc/self/fd is doing the right thing. /proc/self/fd doesn't
seem to be a security hole, unless I'm missing something. I think flink()
would be a security risk, though. Or did I overlook something?