Prev: [PATCH 1/9 v3] staging: dt3155: check put_user() return value
Next: Over-eager swapping
From: Valdis.Kletnieks on 2 Aug 2010 09:10
On Mon, 02 Aug 2010 13:20:01 +0200, Miklos Szeredi said:

> Index: linux-2.6/fs/dcache.c
> ===================================================================
> --- linux-2.6.orig/fs/dcache.c 2010-07-06 18:08:16.000000000 +0200
> +++ linux-2.6/fs/dcache.c 2010-07-06 18:08:19.000000000 +0200
> @@ -1977,8 +1977,7 @@ global_root:
> * @buffer: buffer to return value in
> * @buflen: buffer length
> *
> - * Convert a dentry into an ASCII path name. If the entry has been deleted
> - * the string " (deleted)" is appended. Note that this is ambiguous.
> + * Convert a dentry into an ASCII path name.
> *
> * Returns a pointer into the buffer or an error code if the
> * path was too long.

I'd prefer the comment about it being ambiguous remain. I'm waiting to see how
long it takes for somebody to create a security hole by creating a file called
'/etc/some/thing/important (deleted)' and having some software Do The Wrong
Thing instead to /etc/some/thing/important.

From: Bastien ROUCARIES on 2 Aug 2010 09:30
On Mon, Aug 2, 2010 at 3:00 PM, <Valdis.Kletnieks(a)vt.edu> wrote:
> On Mon, 02 Aug 2010 13:20:01 +0200, Miklos Szeredi said:
>
>> Index: linux-2.6/fs/dcache.c
>> ===================================================================
>> --- linux-2.6.orig/fs/dcache.c � � � �2010-07-06 18:08:16.000000000 +0200
>> +++ linux-2.6/fs/dcache.c � � 2010-07-06 18:08:19.000000000 +0200
>> @@ -1977,8 +1977,7 @@ global_root:
>> � * @buffer: buffer to return value in
>> � * @buflen: buffer length
>> � *
>> - * Convert a dentry into an ASCII path name. If the entry has been deleted
>> - * the string " (deleted)" is appended. Note that this is ambiguous.
>> + * Convert a dentry into an ASCII path name.
>> � *
>> � * Returns a pointer into the buffer or an error code if the
>> � * path was too long.
>
> I'd prefer the comment about it being ambiguous remain. �I'm waiting to see how
> long it takes for somebody to create a security hole by creating a file called
> '/etc/some/thing/important (deleted)' and having some software Do The Wrong
> Thing instead to /etc/some/thing/important.
>

In order to close this kind of hole why not creating a deleted
directory on /proc and redirect symbolic link to this directory.
And do the same for unreachable. If we use the good permission it will
work from a backaward compatibily point of view

bastien
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Miklos Szeredi on 2 Aug 2010 09:40
On Mon, 02 Aug 2010, Valdis.Kletnieks(a)vt.ed wrote:
> On Mon, 02 Aug 2010 13:20:01 +0200, Miklos Szeredi said:
>
> > Index: linux-2.6/fs/dcache.c
> > ===================================================================
> > --- linux-2.6.orig/fs/dcache.c 2010-07-06 18:08:16.000000000 +0200
> > +++ linux-2.6/fs/dcache.c 2010-07-06 18:08:19.000000000 +0200
> > @@ -1977,8 +1977,7 @@ global_root:
> > * @buffer: buffer to return value in
> > * @buflen: buffer length
> > *
> > - * Convert a dentry into an ASCII path name. If the entry has been deleted
> > - * the string " (deleted)" is appended. Note that this is ambiguous.
> > + * Convert a dentry into an ASCII path name.
> > *
> > * Returns a pointer into the buffer or an error code if the
> > * path was too long.
>
> I'd prefer the comment about it being ambiguous remain. I'm waiting
> to see how long it takes for somebody to create a security hole by
> creating a file called '/etc/some/thing/important (deleted)' and
> having some software Do The Wrong Thing instead to
> /etc/some/thing/important.

The same comment is left intact on top of d_path().

It is removed from __d_path() because this function no longer appends
"(deleted)".

Thanks,
Miklos
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Valdis.Kletnieks on 2 Aug 2010 11:20
On Mon, 02 Aug 2010 15:35:20 +0200, Miklos Szeredi said:

> > I'd prefer the comment about it being ambiguous remain. I'm waiting
> > to see how long it takes for somebody to create a security hole by
> > creating a file called '/etc/some/thing/important (deleted)' and
> > having some software Do The Wrong Thing instead to
> > /etc/some/thing/important.
>
> The same comment is left intact on top of d_path().
>
> It is removed from __d_path() because this function no longer appends
> "(deleted)".

Oh, OK. Obviously -ENOCAFFEINE on my part, I thought you were nuking the
d_path() copy. ;)

 | 
Pages: 1
Prev: [PATCH 1/9 v3] staging: dt3155: check put_user() return value
Next: Over-eager swapping