From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752365AbdJCQkT (ORCPT <rfc822;w@1wt.eu>);
        Tue, 3 Oct 2017 12:40:19 -0400
Received: from imap.thunk.org ([74.207.234.97]:58820 "EHLO imap.thunk.org"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1751148AbdJCQkR (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 3 Oct 2017 12:40:17 -0400
Date: Tue, 3 Oct 2017 12:40:12 -0400
From: "Theodore Ts'o" <tytso@mit.edu>
To: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Adam Borowski <kilobyte@angband.pl>, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] vfs: hard-ban creating files with control characters in
 the name
Message-ID: <20171003164012.r4qnn5cr5kzmnft6@thunk.org>
Mail-Followup-To: Theodore Ts'o <tytso@mit.edu>,
        Al Viro <viro@ZenIV.linux.org.uk>,
        Adam Borowski <kilobyte@angband.pl>, linux-fsdevel@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20171003005042.16470-1-kilobyte@angband.pl>
 <20171003020724.GH21978@ZenIV.linux.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20171003020724.GH21978@ZenIV.linux.org.uk>
User-Agent: NeoMutt/20170609 (1.8.3)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: tytso@thunk.org
X-SA-Exim-Scanned: No (on imap.thunk.org); SAEximRunCond expanded to false
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Oct 03, 2017 at 03:07:24AM +0100, Al Viro wrote:
> That essay is full of shit, and you've even mentioned parts of that just above...
> NAK; you'd _still_ need proper quoting (or a shell with something resembling an
> actual syntax, rather than the "more or less what srb had ended up implementing"),
> so it doesn't really buy you anything.  Badly written script will still be
> exploitable.  And since older kernels and other Unices are not going away,
> you would've created an inconsistently vulnerable set of scripts, on top of
> the false sense of security.

Banning certain characters is certainly not a panacea, and there are a
lot of best practices that you have to follow when writing good
scripts which most people don't follow, and so it's arguable that
benefits are being overstated.

That being said the costs of suppressing certain bytes from appearing
in pathnames seem fairly low.  Would this be more palatable if the ban
on control characters were made into a compile-time or mount-time
option?

						- Ted