On Thu, Jul 12, 2018 at 08:50:46AM -0700, Linus Torvalds wrote: > But "write()" simply is *NOT* a good "command" interface. If you want > to send a command, use an ioctl or a system call. > > Because it's not just about credentials. It's not just about fooling a > suid app into writing an error message to a descriptor you wrote. It's > also about things like "splice()", which can write to your target > using a kernel buffer, and thus trick you into doing a command while > we have the context set to kernel addresses. Wait a sec - that's only a problem if your command contains pointer-chasing et.al. Which is why e.g. /dev/sg is fucked in head. But for something that is plain text, what's the problem with splice/write/sendmsg/whatever? I'm not talking about this particular interface, but "write is bad for commands" as general policy looks missing the point. If anything, it's pointer-chasing crap that should be banned everywhere. Just look at SG_IO - it's a ioctl, and it's absolute garbage...
