From patchwork Mon Mar 9 15:16:34 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Drysdale X-Patchwork-Id: 5968641 Return-Path: X-Original-To: patchwork-fstests@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D962A9F380 for ; Mon, 9 Mar 2015 15:17:04 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5634320279 for ; Mon, 9 Mar 2015 15:16:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5A6B420259 for ; Mon, 9 Mar 2015 15:16:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754564AbbCIPQ5 (ORCPT ); Mon, 9 Mar 2015 11:16:57 -0400 Received: from mail-vc0-f177.google.com ([209.85.220.177]:64238 "EHLO mail-vc0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753726AbbCIPQ4 convert rfc822-to-8bit (ORCPT ); Mon, 9 Mar 2015 11:16:56 -0400 Received: by mail-vc0-f177.google.com with SMTP id id10so9998516vcb.8 for ; Mon, 09 Mar 2015 08:16:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; bh=psJRemfKZZjcPG4MhpdP21bJrUNe6nGxTxZ5fGN/FPw=; b=gxDgE0sslF1h7LwnVuw5SB7/0BfuzmBk9xiGLtJx4o9wMe+l/IsuU/RfoJMuuHabfQ BFyvuoqDxoCwzuKNfTwJ/e4tp8WgKntxZshHMnEhF6JMFFhKkNHJA4KoDbZWpMWgmhaK YxTIWIeNZ4OQEadpUjMT5z41fsNxuE2Bo3bpjccbYytgxzyrciqMue7YH+XCIYbbl6eq 9dt0OOJ/zAMDLa6q3b4eMy+qi9oAaPU3se6OYG83mwfHoh2n5TAVL/QNRgtQEWHc6gYr +ElLG1UA0cmMjLOEDLKVPgmldENcDZZhailyLflsDruHglXyF4dXYAvJW09BqcbfXyjX Yzww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type:content-transfer-encoding; bh=psJRemfKZZjcPG4MhpdP21bJrUNe6nGxTxZ5fGN/FPw=; b=NetRB1x3Gde/qsqquw78MlT0axu2Pj5D7vW64SHxIMvRYXZ4kizGBEEz4X5vnt0y7p ZDthfhISeQGVdYTHshazohEoXlCUgKyfud+UYfPFG5zYy4pVOiK4lWhyypwGDxOiOff1 BsqT0ZfRGS41lIvwp5yJleBzY2W0da9H4OBvuFNfy+4883cus6YL04u4iyKrTBaLQrAk UpEwFJjVs5CLLAjYQUShmvH2xiayamPyuOXaoH0+XLmd/j4smKzSW6gNCbqV3txpBSAm wH36SArs6BT3tWyfLJvzRdocGzZiSPY3RMfHNeSJV0mV22UhkLNKl4KsUD8nfvXdIV/6 EvWQ== X-Gm-Message-State: ALoCoQl7ldzhkOTVBwyU48lh5+TH5OmDrDo42A7u4pGcuESwGRldjTJj6tdst4fbbekozY+Y3RKs X-Received: by 10.52.5.225 with SMTP id v1mr386977vdv.15.1425914215148; Mon, 09 Mar 2015 08:16:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.52.29.228 with HTTP; Mon, 9 Mar 2015 08:16:34 -0700 (PDT) In-Reply-To: <54FDAF16.2030407@gmail.com> References: <1425909612-28034-1-git-send-email-drysdale@google.com> <1425909612-28034-4-git-send-email-drysdale@google.com> <54FDAF16.2030407@gmail.com> From: David Drysdale Date: Mon, 9 Mar 2015 15:16:34 +0000 Message-ID: Subject: Re: [PATCHv3 man-pages 3/3] open.2: describe O_BENEATH flag To: "Michael Kerrisk (man-pages)" Cc: "linux-kernel@vger.kernel.org" , Alexander Viro , Kees Cook , "Eric W. Biederman" , Greg Kroah-Hartman , Meredydd Luff , Will Drewry , Jorge Lucangeli Obes , Ricky Zhou , Lee Campbell , Julien Tinnes , Mike Depinet , James Morris , Andy Lutomirski , Paolo Bonzini , Paul Moore , Christoph Hellwig , Linux API , LSM List , fstests@vger.kernel.org Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Mon, Mar 9, 2015 at 2:32 PM, Michael Kerrisk (man-pages) wrote: > On 03/09/2015 03:00 PM, David Drysdale wrote: >> Signed-off-by: David Drysdale > > Hi David, > > The text looks good insofar as it goes. But, it would be helpful > to have sentence or to that explains why this flag exists. > Could you add that, please? > > Thanks, > > Michael How about something like: This feature allows applications to be sure that the opened file is within the specified directory, regardless of the original source of the pathname argument. Some security-conscious pro? grams may further ensure this by imposing a system call filter (with seccomp(2)) that requires this flag for all open() opera? tions, so that the program cannot open files outside of speci? fied directories even if subverted. (Also, I realize that I somehow failed to notice that the flags are listed in alphabetical order, so I'll move the text up, as in the updated diff below). Thanks, David --- man2/open.2 | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) refers to a file on a read-only filesystem and write access was diff --git a/man2/open.2 b/man2/open.2 index 956531b24b26..ece1fa90775a 100644 --- a/man2/open.2 +++ b/man2/open.2 @@ -201,6 +201,43 @@ See for further details. See also BUGS, below. .TP +.B O_BENEATH " (since Linux 4.??)" +Ensure that the +.I pathname +is beneath the current working directory (for +.BR open (2)) +or the +.I dirfd +(for +.BR openat (2)). +If the +.I pathname +is absolute or contains a path component of "..", the +.BR open () +fails with the error +.BR EPERM. +This occurs even if ".." path component would not actually +escape the original directory; for example, a +.I pathname +of "subdir/../filename" would be rejected. +Path components that are symbolic links to absolute paths, or that are +relative paths containing a ".." component, will also cause the +.BR open () +operation to fail with the error +.BR EPERM. + +This feature allows applications to be sure that the opened file is +within the specified directory, regardless of the original source of the +.I pathname +argument. +Some security-conscious programs may further ensure +this by imposing a system call filter (with +.BR seccomp (2)) +that requires this flag for all +.BR open () +operations, so that the program cannot open files outside of +specified directories even if subverted. +.TP .BR O_CLOEXEC " (since Linux 2.6.23)" .\" NOTE! several other man pages refer to this text Enable the close-on-exec flag for the new file descriptor. @@ -984,6 +1021,13 @@ did not match the owner of the file and the caller was not privileged The operation was prevented by a file seal; see .BR fcntl (2). .TP +.B EPERM +The +.B O_BENEATH +flag was specified and the +.I pathname +was not beneath the relevant directory. +.TP .B EROFS .I pathname