From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752753AbdDKSHK (ORCPT ); Tue, 11 Apr 2017 14:07:10 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49306 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751995AbdDKSHI (ORCPT ); Tue, 11 Apr 2017 14:07:08 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 70160C054908 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=eblake@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 70160C054908 Subject: Re: [PATCH 1/2] vfs: implement fchmodat2() syscall To: Colin Walters , Greg Kurz , viro@zeniv.linux.org.uk References: <148830142269.7103.7429913851447595016.stgit@bahia> <99466bd0-48f2-1594-5392-5e6191d56ffa@redhat.com> <1491933162.45759.941552624.3722F8E8@webmail.messagingengine.com> <02954403-b546-0afe-39c7-23b7b05dece2@redhat.com> Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org From: Eric Blake Openpgp: url=http://people.redhat.com/eblake/eblake.gpg Organization: Red Hat, Inc. Message-ID: <9005445d-2a56-effd-55da-b3bc700c5cf2@redhat.com> Date: Tue, 11 Apr 2017 13:07:02 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <02954403-b546-0afe-39c7-23b7b05dece2@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="siVjjvjQFTthX9bDsF0aXAlogeHIfrcLp" X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Tue, 11 Apr 2017 18:07:07 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --siVjjvjQFTthX9bDsF0aXAlogeHIfrcLp Content-Type: multipart/mixed; boundary="9HEO0EAwFaDltrI5TKhIIsg2fGBNwqrPU"; protected-headers="v1" From: Eric Blake To: Colin Walters , Greg Kurz , viro@zeniv.linux.org.uk Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Message-ID: <9005445d-2a56-effd-55da-b3bc700c5cf2@redhat.com> Subject: Re: [PATCH 1/2] vfs: implement fchmodat2() syscall References: <148830142269.7103.7429913851447595016.stgit@bahia> <99466bd0-48f2-1594-5392-5e6191d56ffa@redhat.com> <1491933162.45759.941552624.3722F8E8@webmail.messagingengine.com> <02954403-b546-0afe-39c7-23b7b05dece2@redhat.com> In-Reply-To: <02954403-b546-0afe-39c7-23b7b05dece2@redhat.com> --9HEO0EAwFaDltrI5TKhIIsg2fGBNwqrPU Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 04/11/2017 12:55 PM, Eric Blake wrote: > On 04/11/2017 12:52 PM, Colin Walters wrote: >> >> >> On Tue, Feb 28, 2017, at 02:23 PM, Eric Blake wrote: >> >>> Might also be worth mentioning that this patch is required in order t= o >>> solve CVE-2016-9602, per discussion at >>> https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg06089.html >> >> I only briefly looked at this, but can't `open(..., O_PATH)` be used t= o solve >> this today? >=20 > O_PATH was the fallback that qemu used Hmm - actually, qemu used O_PATH for the directory portion of *at traversals: git.qemu-project.org/?p=3Dqemu.git;a=3Dcommitdiff;h=3D918112c but did not use O_PATH for its chmod() fallback: git.qemu-project.org/?p=3Dqemu.git;a=3Dcommitdiff;h=3De3187a4 A good idea on the surface. But reading the man page of openat(), the section on O_PATH says: The file itself is not opened, and other file operations (e.g., read(2), write(2), fchmod(2), fchown(2), fgetxattr(2), mmap(2)) fail with the error EBADF. > - but that's non-POSIX, which > means we have to have a different solution for POSIX systems than for > Linux systems, while waiting for Linux to catch up to POSIX. But even if using open(O_PATH)/fchmod() works, it is not immediately obvious whether it can catch all the same cases that chmodat(O_NOFOLLOW) would cover, as there are cases where you have permissions to change mode bits but not open() the file for reading or writing. And even if it gets rid of a TOCTTOU race, it still is a 2-syscall hit rather than an atomic single syscall. --=20 Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org --9HEO0EAwFaDltrI5TKhIIsg2fGBNwqrPU-- --siVjjvjQFTthX9bDsF0aXAlogeHIfrcLp Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJY7RtGAAoJEKeha0olJ0NqkV4H/iVfPIqzIPqBlFzzj1lN0qGM 7ehLKh+IhnHeqUX40wteGKUdAvce6EFWGeqe+S5kbmhgkYjfsOQCqWKaP/Vx2Waw uYUD0y3k5aWY/dlDg3j6S4SbEikvMSDStFWnBgbHDc8DrWzDEzcEDWvaB9BdrQC2 J61bwGMc6lDD3vInVbEa4FB7p25qpAw94pccgIJtcL8Gw22qj7l+ViReCU+qmaEm ruYkSNLf5zSNe5Kqf0JdBS47iygyoG7Kdyc1D1cbOnhQhuXRLe/w9ldh5cD9l+QH ZTez7hErF736xTlM6RE5xsrVWJZ9lp72jQEnD4bpO1CuAejlq7cHssxZMaXrkfc= =UByb -----END PGP SIGNATURE----- --siVjjvjQFTthX9bDsF0aXAlogeHIfrcLp--