Page MenuHomeFreeBSD

open.2: describe O_RESOLVE_BENEATH errors correctly
ClosedPublic

Authored by val_packett.cool on Feb 19 2023, 8:18 PM.
Tags
None
Referenced Files
F105514928: D38675.diff
Tue, Dec 17, 3:33 AM
Unknown Object (File)
Tue, Dec 10, 4:30 PM
Unknown Object (File)
Fri, Nov 29, 4:44 AM
Unknown Object (File)
Thu, Nov 28, 11:23 PM
Unknown Object (File)
Tue, Nov 26, 3:51 AM
Unknown Object (File)
Wed, Nov 20, 10:32 PM
Unknown Object (File)
Tue, Nov 19, 7:16 AM
Unknown Object (File)
Nov 16 2024, 1:16 AM

Details

Summary

The behavior is the same as in capability mode, it does not actually
return EINVAL for absolute lookups:

openat(AT_FDCWD,"/tmp/test",O_RDONLY|O_DIRECTORY,00) = 3 (0x3)
openat(3,"../../",O_RDONLY|0x800000,00)          ERR#93 'Capabilities insufficient'
openat(3,"/etc/passwd",O_RDONLY|0x800000,00)     ERR#93 'Capabilities insufficient'

Fixes: 1f305be43 ("Document {O,AT}_RESOLVE_BENEATH...")
Sponsored by: https://www.patreon.com/valpackett

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

pauamma_gundo.com added inline comments.
lib/libc/sys/open.2
602–628

I'm not sure this is as clear as the previous version. "A, or B, and C or D" leaves me unsure whether the "C or D" restriction applies to B only, or to both A and B. I don't think the previous version had that ambiguity.

Hopefully more clear this way?

It helps. So (I think) does removing some of the commas. What do others think?

lib/libc/sys/open.2
602–628

The common practice in the error section of the man pages is to list each cause separately, repeating the error number (symbol). So your change would be better done in opposite direction, IMO: splitting the 'absolute path', 'dotdot', and 'dotdot' leading outside the root.

Note that allowance for dotdot presence is controlled by a sysctl knob.

Yeah, makes sense, let's try like this

Minor nits, fixable on commit.

lib/libc/sys/open.2
31

Remember to bump.

611

For tense consistency with "is"

625–628
633
This revision is now accepted and ready to land.Feb 20 2023, 9:31 PM