Dan Yefimov said: >> I do not think mounting /proc should change access control semantics. >> >It didn't in fact change anything. If the guest created hardlink to that file in >a unrestricted location, what would you say? Procfs is in that respect just >another sort of hardlinks, whether you like that or not. If you didn't in fact >restrict an access to the file, you're on your own. (1) This is WRONG, and I find it interesting that nobody bothered to check or test this. The POSIX standard mandates that link() shall fail if the user has no search permission for any of the directories in the path prefix of oldpath or newpath. Therefore, setting the directory permission to 0700 protects from hardlink creation (read that again!) and this bug in the /proc filesystem indeed lead to a change in access control semantics. Under POSIX, the file IS unwriteable, because it is protected by the permissions on the parent directory. (2) While it's irrelevant for his argument, the script by Pavel Machek has a race condition. The 'chmod 700 /tmp/my_priv' should be done before the file is created, not afterwards. Otherwise there is a window where the file exists, but hardlink creation is not prevented by the directory permissions. Isara
