3 ms·
Yeah, I have read about the precursors of those patches. But this has been simmering for a long time. The point is that one could do this correctly today with
by the8472 7y ago
Yeah, I have read about the precursors of those patches. But this has been simmering for a long time.
The point is that one could do this correctly today with the right rituals. openat2 wouldn't save you if you were still doing plain realpath+open across a security boundary even though openat+procfs or setns are available.
The new syscall implementation would still need a fallback impl. for older kernels after all.
- cyphar 7y ago> The new syscall implementation would still need a fallback impl. for older kernels after all. Yup, this is why I'm planning on getting a sane API available in <https://github.com/cyphar/filepath-securejoin> https://github.com/cyphar/filepath-securejoin> which projects can use so that the correct thing is done with both old and new kernels. Right now it has a (slighly) improved version of the code Docker has, but I'm rewriting it. It should be noted that there are lots of examples of interfaces which are incredibly hard to make safe without openat2 -- such as O_CREAT.