-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is a refresh of a patch I've sent quite some time ago (in April).
That old patch introduced a flink() syscall without proper security
measures.  I've now integrated a proposal for how to fix it.

int flink (int fd, const char *newname)

The file associated with fd is linked with the newname.  But this will
only succeed if the file descriptor fd was created with the O_CANLINK
flag set.  It is not possible to set O_CANLINK afterwards,
fcntl(F_SETFL) cannot set the bit, this is important.

The changes to implement this are pretty trivial.  The patch consists of
more than a few lines only because the link code is reusing as much as
possible in the link() and flink() code and the O_* flags definitions
were reformatted.


The purpose of this change is two fold.

For now it is possible to use this functionality in a couple of ways:

~ we can create quasi-anonymous files.  Like

    fd = open ("RANDOM", O_EXCL|O_CREAT|O_CANLINK|O_RDWR, 0600);
    unlink ("RANDOM");
    ... do some work ...
    if (work is auccessful)
      flink (fd, "REALNAME");
    close (fd)

~ file descriptors which are passed to a process (by inheritance from
the parent, through Unix sockets, ...) can be linked to the filesystem.


Longer-term I think the kernel should support real anonymous files which
can optionally be created with the O_CANLINK flag.  This would "only"
save the unlink() call in the example above but not having the file at
all in the filesystem namespace eliminates one more possible attack vector.

This patch covers so far only x86.

- --
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/5T0n2ijCOnn/RHQRAmEOAJ9ZiAfMl0EcudUUREFki0Axpp/MLwCfc9qS
HMTHoEkve1Tjc70jQTvdElw=
=InNQ
-----END PGP SIGNATURE-----