diff --git a/lib/libsys/access.2 b/lib/libsys/access.2 --- a/lib/libsys/access.2 +++ b/lib/libsys/access.2 @@ -25,7 +25,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd May 13, 2024 +.Dd May 21, 2024 .Dt ACCESS 2 .Os .Sh NAME @@ -147,15 +147,6 @@ .Dv R_OK and .Dv W_OK . -.Pp -.Fn access , -.Fn eaccess -and -.Fn faccessat -will always dereference symbolic links. -If the symbolic link itself needs to be referenced, -.Xr lstat 2 -should be used instead. .Sh RETURN VALUES .Rv -std .Sh ERRORS @@ -254,25 +245,17 @@ .Fx 8.0 . .Sh SECURITY CONSIDERATIONS The -.Fn access -system call -is a potential security hole due to race conditions and -should never be used. -Set-user-ID and set-group-ID applications should restore the -effective user or group ID, -and perform actions directly rather than use -.Fn access -to simulate access checks for the real user or group ID. -The -.Fn eaccess -system call -likewise may be subject to races if used inappropriately. +.Fn access , +.Fn eaccess , +and +.Fn faccessat +system calls are subject to time-of-check-to-time-of-use races and +should not be relied upon for file permission enforcement purposes. +Instead, applications should perform the desired action using the +requesting user's credentials. .Pp -.Fn access -remains useful for providing clues to users as to whether operations -make sense for particular filesystem objects (e.g. 'delete' menu -item only highlighted in a writable folder ... avoiding interpretation -of the st_mode bits that the application might not understand -- -e.g. in the case of AFS). -It also allows a cheaper file existence test than -.Xr stat 2 . +For existence checks, either +.Xr lstat 2 +or +.Xr stat 2 +should be used instead.