Hi On Tue, Apr 22, 2014 at 4:31 PM, Pavel Machek <pavel@xxxxxx> wrote: > Such as here? > > http://www.securityfocus.com/archive/1/507386 Thanks, that's the first real example someone mentioned. Quoted from your link: > The reopen does check the inode permission, but it does not require > you have any reachable path to the file. Someone _might_ use that as > a traditional unix security mechanism, but if so it's probably quite rare. In other words, the bug you describe is that /proc/pid/fd/ allows access to objects without a reachable path to the only _real_ filesystem link. But isn't the same true for openat()? Thanks David -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
