On 30/04/2020 10:07, Christian Brauner wrote: > On Thu, Apr 30, 2020 at 11:54:29AM +1000, Aleksa Sarai wrote: >> On 2020-04-28, Mickaël Salaün <mic@xxxxxxxxxxx> wrote: >>> The goal of this patch series is to enable to control script execution >>> with interpreters help. A new RESOLVE_MAYEXEC flag, usable through >>> openat2(2), is added to enable userspace script interpreter to delegate >>> to the kernel (and thus the system security policy) the permission to >>> interpret/execute scripts or other files containing what can be seen as >>> commands. >>> >>> This third patch series mainly differ from the previous one by relying >>> on the new openat2(2) system call to get rid of the undefined behavior >>> of the open(2) flags. Thus, the previous O_MAYEXEC flag is now replaced >>> with the new RESOLVE_MAYEXEC flag and benefits from the openat2(2) >>> strict check of this kind of flags. >> >> My only strong upfront objection is with this being a RESOLVE_ flag. >> >> RESOLVE_ flags have a specific meaning (they generally apply to all >> components, and affect the rules of path resolution). RESOLVE_MAYEXEC >> does neither of these things and so seems out of place among the other >> RESOLVE_ flags. >> >> I would argue this should be an O_ flag, but not supported for the > > I agree. OK, I'll switch back to O_MAYEXEC.
