From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752719AbdEEB1O (ORCPT ); Thu, 4 May 2017 21:27:14 -0400 Received: from mail-it0-f48.google.com ([209.85.214.48]:37679 "EHLO mail-it0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751791AbdEEB1L (ORCPT ); Thu, 4 May 2017 21:27:11 -0400 MIME-Version: 1.0 In-Reply-To: <20170505003030.GM29622@ZenIV.linux.org.uk> References: <20170429220414.GT29622@ZenIV.linux.org.uk> <20170505003030.GM29622@ZenIV.linux.org.uk> From: Linus Torvalds Date: Thu, 4 May 2017 18:27:10 -0700 X-Google-Sender-Auth: OLzfcIlo6Vd5vBprq1oC8X0OPqo Message-ID: Subject: Re: new ...at() flag: AT_NO_JUMPS To: Al Viro Cc: Jann Horn , Linux API , Linux Kernel Mailing List , linux-fsdevel Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, May 4, 2017 at 5:30 PM, Al Viro wrote: > > As for mountpoint crossing... it might make sense to split those. > O_BENEATH allowed it, and if we want AT_BENEATH to match that - let's > do it. Then this one would become AT_BENEATH | AT_XDEV (the latter named > after find(1) option, obviously). So I would still like to split that NO_JUMP flag even more. I like the AT_BENEATH | AT_XDEV split, but I think XDEV should be split further, and I think the symlink avoidance should be split more too. As mentioned last time, at least for the git usage, even relative symlinks are a no-no - not because they'd escape, but simply because git wants to see the *unique* name, and resolve relative symlinks to either the symlink, or to the actual file it points to. So I think that we'd want an additional flag that says "no symlinks at all". And I think the "no mountpoint" traversal might be splittable too. Yes, sometimes you'd probably want to say "stay exactly inside this filesystem" (like find -xdev). So no arguments against AT_XDEV that refuses any mount traversal (kind of like my "no symlink traversal" thing). But at other points you might want to just guarantee that the walk stays below a certain starting point and doesn't escape. That could still allow crossing mount-points, but only if they are non-bind mounts and cannot let us escape. I'm not sure if that's testable, though. Linus