5 ms·
A bit pedantic, but the methods detailed in the blog are vulnerable to time-of-check-to-time-of-use race conditions. The right way to go about this is to use fi
by 10000truths 5y ago
A bit pedantic, but the methods detailed in the blog are vulnerable to time-of-check-to-time-of-use race conditions. The right way to go about this is to use file descriptors wherever possible, so that a stable reference to each intermediate directory is maintained. The openat() and mkdirat() functions should be the go-to for opening and creating intermediate directories.
- kazinator 5y agoThe main purpose of openat() is to plug the hole that the chdir() current working directory in POSIX is process-wide. So if one thread is calling chdir(), it screws with any other thread that uses traditional Unix calls like open() on a relative path. It's really a ham-fisted band-aid to an poorly designed threading system. The whole thing is in incredibly bad taste. If I'm writing traditional, clean, single-threaded Unix, I don't want anything to do with any at() stuff.
- pferde 5y agoBe that as it may, openat/mkdirat is still useful if one wants to avoid TOCTOU, just like grandparent post suggests.
- floatboth 5y agoBut conveniently the at() stuff has allowed for capabilities-based security with Capsicum, CloudABI (RIP) and now WASI. Since the at() functions exist, these environments can just not have a global filesystem namespace – there is no open(), only openat() under the descriptors you have. No escaping up from the sandbox!
- singron 5y agoCan't you openat(fd,"..")? I don't think this is a sufficient sandbox.
- floatboth 5y agoNo, not in a capability-based environment. Once you cap_enter() on FreeBSD, you can't – that's the whole point. Same in proper WASI runtime implementations. Please don't assume people are stupid ;) These sandboxes have been carefully designed and extensively tested.
- justincormack 5y agoopenat2 now has RESOLVE_BENEATH to fix that.
- danachow 5y agoWrong. Read the man page for openat - the main reason for its use is explained and it is not the one you mention, though it is given as a secondary reason. https://linux.die.net/man/2/openat https://linux.die.net/man/2/openat
- jra_samba 5y agoThen you are opening yourself up to a world of subtle security holes with symlinks. The POSIX file system API is a festering sore, an utter disaster. Symlinks are the cause.
- mst 5y agoBring back directory hardlinks!