From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S378418AbdD3BOA (ORCPT ); Sat, 29 Apr 2017 21:14:00 -0400 Received: from mail.kernel.org ([198.145.29.136]:51116 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S378382AbdD3BNv (ORCPT ); Sat, 29 Apr 2017 21:13:51 -0400 MIME-Version: 1.0 In-Reply-To: <20170429232504.GU29622@ZenIV.linux.org.uk> References: <20170429220414.GT29622@ZenIV.linux.org.uk> <20170429232504.GU29622@ZenIV.linux.org.uk> From: Andy Lutomirski Date: Sat, 29 Apr 2017 18:13:27 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: new ...at() flag: AT_NO_JUMPS To: Al Viro Cc: Andy Lutomirski , Linux API , "linux-kernel@vger.kernel.org" , Linux FS Devel Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Apr 29, 2017 at 4:25 PM, Al Viro wrote: > On Sat, Apr 29, 2017 at 04:17:18PM -0700, Andy Lutomirski wrote: >> On Sat, Apr 29, 2017 at 3:04 PM, Al Viro wrote: >> > New AT_... flag - AT_NO_JUMPS >> > >> > Semantics: pathname resolution must not involve >> > * traversals of absolute symlinks >> > * traversals of procfs-style symlinks >> > * traversals of mountpoints (including bindings, referrals, etc.) >> > * traversal of .. in the starting point of pathname resolution. >> >> Can you clarify this last one? I assume that ".." will be rejected, >> but what about "a/../.."? How about "b" if b is a symlink to ".."? >> How about "a/b" if a is a directory and b is a symlink to "../.."? > > All of those will be rejected - in each of those cases pathname traversal > leads back into the starting point with .. being the next component to > handle. Sounds good. Might it make sense to split it into two flags, one to prevent moving between mounts and one for everything else? I can imagine webservers and such that are fine with traversing mount points but don't want to escape their home directory. --Andy