mailing list mirror (one of many)
 help / color / mirror / code / Atom feed
From: "Christian Göttsche" <>
To: Jeff King <>
Cc: "brian m. carlson" <>,
Subject: Re: [PATCH] setup: avoid unconditional open with write flags
Date: Tue, 6 Dec 2022 17:15:03 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

> But it's still no better than the patch here in the happy case, since we
> still have to perform three fcntl() checks to figure out that all three
> descriptors are initialized as-expected (versus just one open() and
> close()).

An alternative to performing three syscalls fot the check one could call
open(2) with O_RDONLY (O_PATH would also work, but seems not
yet to be used in the git source) on a common path ("/", "/dev/null", ...)
and skip the sanitization if the returned descriptor is greater than 2.
This would lead to two (open + close) syscalls in the common case,
same as current.

> If Christian can tighten
> the environment into somewhat unnatural "opening writable FD is a
> failure" way, I suspect such a jail can be augmented to further to
> allow opening /dev/null and other "selected" files writable, so I
> wouldn't worry too much if we dropped this patch entirely.

The seccomp filter only gets the address of the memory where the path
is stored, so simple allow-listing paths is not possible.  And even on
inspection of the path one would need to avoid toctou attacks (the
filter seeing a different memory content at check time than the kernel
at use time).

  reply	other threads:[~2022-12-06 16:19 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-05 19:00 [PATCH] setup: avoid unconditional open with write flags Christian Göttsche
2022-12-05 22:13 ` brian m. carlson
2022-12-06  1:38   ` Jeff King
2022-12-06 16:15     ` Christian Göttsche [this message]
2022-12-05 22:59 ` Taylor Blau
2022-12-06  0:10   ` Junio C Hamano
2022-12-06  0:31     ` Taylor Blau
2022-12-06  0:40       ` Junio C Hamano
2022-12-06 19:47 ` René Scharfe
2022-12-06 23:39   ` Junio C Hamano

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

  List information:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='' \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).