Hi Aleksa, On Tue, 2018-11-13 at 01:26 +1100, Aleksa Sarai wrote: > * O_BENEATH: Disallow "escapes" from the starting point of the > filesystem tree during resolution (you must stay "beneath" the > starting point at all times). Currently this is done by disallowing > ".." and absolute paths (either in the given path or found during > symlink resolution) entirely, as well as all "magic link" jumping. With open_tree(2) and OPEN_TREE_CLONE, will O_BENEATH still be necessary? As I understand it, O_BENEATH could be replaced by a much simpler flag that only disallows absolute paths (incl. absolute symlinks). And it would have the benefit that you can actually pass the tree/directory fd to another process and escaping would not be possible even if that other process doesn't use O_BENEATH (after calling mount_setattr(2) to make sure it's locked down). This approach would also make it easy to restrict writes via a cloned tree/directory fd by marking it read-only via mount_setattr(2) (and locking down the read-only flag). This would again be especially useful when passing tree/directory fds across processes, or for voluntary self-lockdown within a process for robustness against security bugs. This wouldn't affect any of the other flags in this patch. And for full equivalence to O_BENEATH you'd have to use O_NOMAGICLINKS in addition to O_NOABSOLUTE, or whatever that new flag would be called. Or is OPEN_TREE_CLONE too expensive for this use case? Or is there anything else I'm missing? Jürg
