Re: [PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Oleg Nesterov
On 08/21, Andy Lutomirski wrote: > > On Wed, Aug 21, 2013 at 11:20 AM, Oleg Nesterov wrote: > > Can't really comment the patch, just a nit: > > > > On 08/21, Andy Lutomirski wrote: > >> > >> +static bool may_flink(const struct path *path) > >> +{ > >> + bool ret; > >> + struct inode

Re: [PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Andy Lutomirski
On Wed, Aug 21, 2013 at 11:20 AM, Oleg Nesterov wrote: > Can't really comment the patch, just a nit: > > On 08/21, Andy Lutomirski wrote: >> >> +static bool may_flink(const struct path *path) >> +{ >> + bool ret; >> + struct inode *inode = path->dentry->d_inode; >> + >> + /* >> +

Re: [PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Oleg Nesterov
Can't really comment the patch, just a nit: On 08/21, Andy Lutomirski wrote: > > +static bool may_flink(const struct path *path) > +{ > + bool ret; > + struct inode *inode = path->dentry->d_inode; > + > + /* > + * This is racy: I_LINKABLE could be cleared between this check > +

[PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Andy Lutomirski
There have long been two ways to ask the kernel to create a new hardlink to the inode represented by an fd: linkat(..., AT_EMPTY_PATH) and AT_SYMLINK_FOLLOW on /proc/self/fd/N. The latter has no particular security restrictions, but the former required privilege until: commit

[PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Andy Lutomirski
There have long been two ways to ask the kernel to create a new hardlink to the inode represented by an fd: linkat(..., AT_EMPTY_PATH) and AT_SYMLINK_FOLLOW on /proc/self/fd/N. The latter has no particular security restrictions, but the former required privilege until: commit

Re: [PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Oleg Nesterov
Can't really comment the patch, just a nit: On 08/21, Andy Lutomirski wrote: +static bool may_flink(const struct path *path) +{ + bool ret; + struct inode *inode = path-dentry-d_inode; + + /* + * This is racy: I_LINKABLE could be cleared between this check + * and

Re: [PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Andy Lutomirski
On Wed, Aug 21, 2013 at 11:20 AM, Oleg Nesterov o...@redhat.com wrote: Can't really comment the patch, just a nit: On 08/21, Andy Lutomirski wrote: +static bool may_flink(const struct path *path) +{ + bool ret; + struct inode *inode = path-dentry-d_inode; + + /* + *

Re: [PATCH] vfs: Tighten up linkat(..., AT_EMPTY_PATH)

2013-08-21 Thread Oleg Nesterov
On 08/21, Andy Lutomirski wrote: On Wed, Aug 21, 2013 at 11:20 AM, Oleg Nesterov o...@redhat.com wrote: Can't really comment the patch, just a nit: On 08/21, Andy Lutomirski wrote: +static bool may_flink(const struct path *path) +{ + bool ret; + struct inode *inode =