All of
 help / color / mirror / Atom feed
From: Al Viro <>
To: Linus Torvalds <>
Cc: Linux Kernel Mailing List <>,
	linux-fsdevel <>
Subject: Re: [git pull] vfs.git part 2
Date: Fri, 12 Jul 2013 12:54:00 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Fri, Jul 12, 2013 at 06:48:17AM +0100, Al Viro wrote:
> It's slightly less painful than that - if dirname exists, the old kernels
> will fail; O_CREAT for existing directory means an error.  So in practice
> you can use it safely.  I'm not too happy about that situation, but I
> hadn't been able to come up with anything better, short of a new syscall
> that would duplicate openat(2), but reject unknown values in flags argument
> from the very beginning ;-/  Which is what we probably should've done with
> openat(2) itself, but it's too late for that now...

FWIW, it might make sense to do sys_openat2() that would really validate
the 'flags' argument.  The question is, what checks do we want to do?
The situation for open(2) is complicated by OSF, HPUX and Solaris compat.
AFAICS, we have the following picture:

* two bits are used to encode O_RDONLY/O_WRONLY/O_RDWR/open-for-ioctl
Any combination is allowed.  Ignored with O_PATH.

* O_CLOEXEC - orthogonal to everything else

arch-independent (O_NDELAY may or may not coincide with O_NONBLOCK,
on parisc O_NOATIME is the same value as O_INVISIBLE, whatever that is).
Can be changed by fcntl(), probably shouldn't be allowed with O_PATH
(right now we just ignore those in that case).  For that matter, F_SETFL
makes no sense for O_PATH descriptors.  O_APPEND makes no sense for O_RDONLY
opens; might be better to leave that as-is, though.

* O_DIRECTORY - shouldn't be allowed with O_TMPFILE.  Requires either O_RDONLY
or O_PATH (in which case both lower bits are ignored anyway).

* O_NOFOLLOW - orthogonal to everything else

* O_NOCTTY, O_LARGEFILE - probably shouldn't be allowed with O_PATH (currently
ignored in that case).

* O_CREAT - makes no sense with O_PATH.  O_TMPFILE currently demands it, but
that's just an attempt to get it fail on old kernels more reliably.

* O_TRUNC - makes no sense with O_PATH.  Pointless with O_TMPFILE.

* O_EXCL - $DEITY-awful mess.  Combination with O_CREAT is probably the
most regular part; however, it is usable without O_CREAT for some
devices, with varying semantics.  I'd mapped "can't link tmpfile in place"
semantics on that one (with O_CREAT | O_TMPFILE).

* O_SYNC and things around it - arch-dependent mess.

* O_BLKSEEK, etc. - weird flags from HPUX; ignored by the kernel,
OSF fortunately has only O_SYNC/O_DSYNC near that pile and that's the only
one we might realistically care about - Solaris compat is gone and HPUX
one is not much better off.

IMO we should fail on any unknown bits if we go that way, and probably
tighten O_PATH side of things as well.  It's still not too late - we can
just add sys_openat2() and make sys_openat() ignore O_TMPFILE completely.
Do you want to go that way?  If so, let's decide what validation will be
done and spell it out explicitly...

  reply	other threads:[~2013-07-12 11:54 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-07-03 12:29 [git pull] vfs.git part 2 Al Viro
2013-07-11 21:42 ` Linus Torvalds
2013-07-12  5:48   ` Al Viro
2013-07-12 11:54     ` Al Viro [this message]
2013-07-12 12:02     ` Rasmus Villemoes
2013-07-12 15:48       ` Al Viro
2013-07-12 16:30         ` Rasmus Villemoes
2013-07-12 19:13           ` Al Viro
2013-07-12 19:39             ` Al Viro
2013-07-12 20:21               ` Linus Torvalds
2013-07-12 21:16                 ` Al Viro
2013-07-15 23:13                 ` Rasmus Villemoes
2013-07-12 19:42             ` Linus Torvalds
2013-07-12 20:02               ` Al Viro
2017-07-05  7:14 Al Viro

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.