Re: [PATCH v4 2/4] namei: O_BENEATH-style path resolution flags

On Nov 23, 2018, at 5:10 AM, Jürg Billeter [off-list ref] wrote:

Hi Aleksa,

quoted

On Tue, 2018-11-13 at 01:26 +1100, Aleksa Sarai wrote:
* O_BENEATH: Disallow "escapes" from the starting point of the
 filesystem tree during resolution (you must stay "beneath" the
 starting point at all times). Currently this is done by disallowing
 ".." and absolute paths (either in the given path or found during
 symlink resolution) entirely, as well as all "magic link" jumping.

With open_tree(2) and OPEN_TREE_CLONE, will O_BENEATH still be
necessary?

This discussion reminds me of something I’m uncomfortable with in the
current patches: currently, most of the O_ flags determine some
property of the returned opened file.  The new O_ flags you're adding
don't -- instead, they affect the lookup of the file.  So O_BENEATH
doesn't return a descriptor that can only be used to loop up files
beneath it -- it just controls whether open(2) succeeds or fails.  It
might be nice for the naming of the flags to reflect this.  I also
don't love that we have some magic AT_ flags that work with some
syscalls and some magic O_ flags that work with others.

In this regard, I liked the AT_ naming better.  Although I don't love
adding AT_ flags because the restrict our ability to usefully use the
high bits of the fd in the future.

--Andy