On Wed, Sep 14, 2011 at 18:48 +0400, Vasiliy Kulikov wrote: > > So, there is no *new* hole. > > Actually now I see the difference between having something mapped and > having an _fd_ of this something. > > Relevant code: > > +static struct dentry * > +proc_map_files_instantiate(struct inode *dir, struct dentry *dentry, > + struct task_struct *task, const void *ptr) > +{ > ... > + inode->i_mode = S_IFLNK; > + > + if (file->f_mode & FMODE_READ) > + inode->i_mode |= S_IRUSR | S_IXUSR; > + if (file->f_mode & FMODE_WRITE) > + inode->i_mode |= S_IWUSR | S_IXUSR; > > > If you have a write mmap area, but no fd, you may not trunc a file; with > map_files/ you may get an fd and ftrunc it. Also it unconditionally adds +x, but I don't think it breaks any security assumption as (1) there is no +s and (2) fd is not a directory. Thanks, -- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html