fs: Allow unprivileged linkat(..., AT_EMPTY_PATH) aka flink
Every now and then someone proposes a new flink syscall, and this spawns a long discussion of whether it would be a security problem. I think that this is missing the point: flink is *already* allowed without privilege as long as /proc is mounted -- it's called AT_SYMLINK_FOLLOW. Now that O_TMPFILE is here, the ability to create a file with O_TMPFILE, write it, and link it in is very convenient. The only problem is that it requires that /proc be mounted so that you can do: linkat(AT_FDCWD, "/proc/self/fd/<tmpfd>", dfd, path, AT_SYMLINK_NOFOLLOW) This sucks -- it's much nicer to do: linkat(tmpfd, "", dfd, path, AT_EMPTY_PATH) Let's allow it. If this turns out to be excessively scary, it we could instead require that the inode in question be I_LINKABLE, but this seems pointless given the /proc situation Signed-off-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Родитель
e305f48bc4
Коммит
bb2314b479
10
fs/namei.c
10
fs/namei.c
|
@ -3671,15 +3671,11 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
|
|||
if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
|
||||
return -EINVAL;
|
||||
/*
|
||||
* To use null names we require CAP_DAC_READ_SEARCH
|
||||
* This ensures that not everyone will be able to create
|
||||
* handlink using the passed filedescriptor.
|
||||
* Using empty names is equivalent to using AT_SYMLINK_FOLLOW
|
||||
* on /proc/self/fd/<fd>.
|
||||
*/
|
||||
if (flags & AT_EMPTY_PATH) {
|
||||
if (!capable(CAP_DAC_READ_SEARCH))
|
||||
return -ENOENT;
|
||||
if (flags & AT_EMPTY_PATH)
|
||||
how = LOOKUP_EMPTY;
|
||||
}
|
||||
|
||||
if (flags & AT_SYMLINK_FOLLOW)
|
||||
how |= LOOKUP_FOLLOW;
|
||||
|
|
Загрузка…
Ссылка в новой задаче