Re: [RFC/PATCH] revoke/frevoke system calls V2

[Edgar Toernig <froese@gmx.de>]

Alan Cox wrote:
>
> Ar Llu, 2006-08-07 am 17:24 -0500, ysgrifennodd Chase Venters:
> > implementation is crude. "EBADF" is not something that applications are 
> > taught to expect. Someone correct me if I'm wrong, but I can think of no 
> > situation under which a file descriptor currently gets yanked out from 
> > under your feet -- you should always have to formally abandon it with 
> > close().
> 
> The file descriptor is not pulled from under you, the access to it is.
> This is exactly what occurs today when a tty is hung up.

If I read the code correctly, the behaviour for hung up ttys is completely
different: read returns EOF, write returns EIO, select/poll/epoll return
ready, close works.  As rather boring but totally sane behaviour for an fd.

But after revoke you get EBADF for any operation, even select or close.
The fd becomes nearly indistinguishable from a really closed fd (the only
difference is that the fd-number won't be reused (potentional DoS)).
And IMHO that's insane that a regular user may close fds in someone else's
processes (or munmap some of its memory).  I already see people trying
to exploit bugs in system services:

	for (;;) revoke("index.html");
	for (;;) revoke("some_print_job");
	for (;;) revoke("some_mail");

Ciao, ET.