To get an operable version of an O_PATH file descriptor, it is possible to use openat(fd, ".", O_DIRECTORY) for directories, but other files currently require going through open("/proc/<pid>/fd/<nr>"), which depends on a functioning procfs. This patch adds the O_EMPTYPATH flag to openat(2)/openat2(2). If passed, LOOKUP_EMPTY is set at path resolution time. Note: This implies that you cannot rely anymore on disabling procfs from being mounted (e.g. inside a container without procfs mounted and with CAP_SYS_ADMIN dropped) to prevent O_PATH fds from being re-opened read-write.
Unified · Split
| @@ -1169,7 +1169,7 @@ static int __init fcntl_init(void) · 1168 unmodified lines | |||
| 1169 | * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY | 1169 | * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY |
| 1170 | * is defined as O_NONBLOCK on some platforms and not on others. | 1170 | * is defined as O_NONBLOCK on some platforms and not on others. |
| 1171 | */ | 1171 | */ |
| 1172 | BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != | 1172 | BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != |
| 1173 | HWEIGHT32( | 1173 | HWEIGHT32( |
| 1174 | (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) | | 1174 | (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) | |
| 1175 | __FMODE_EXEC)); | 1175 | __FMODE_EXEC)); |
| @@ -1158,7 +1158,7 @@ struct file *kernel_file_open(const struct path *path, int flags, · 1157 unmodified lines | |||
| 1158 | EXPORT_SYMBOL_GPL(kernel_file_open); | 1158 | EXPORT_SYMBOL_GPL(kernel_file_open); |
| 1159 | 1159 | ||
| 1160 | #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) | 1160 | #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) |
| 1161 | #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC) | 1161 | #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC | O_EMPTYPATH) |
| 1162 | 1162 | ||
| 1163 | inline struct open_how build_open_how(int flags, umode_t mode) | 1163 | inline struct open_how build_open_how(int flags, umode_t mode) |
| 1164 | { | 1164 | { |
| @@ -1279,6 +1279,8 @@ inline int build_open_flags(const struct open_how *how, struct open_flags *op) · 114 unmodified lines | |||
| 1279 | lookup_flags |= LOOKUP_DIRECTORY; | 1279 | lookup_flags |= LOOKUP_DIRECTORY; |
| 1280 | if (!(flags & O_NOFOLLOW)) | 1280 | if (!(flags & O_NOFOLLOW)) |
| 1281 | lookup_flags |= LOOKUP_FOLLOW; | 1281 | lookup_flags |= LOOKUP_FOLLOW; |
| 1282 | if (flags & O_EMPTYPATH) | ||
| 1283 | lookup_flags |= LOOKUP_EMPTY; | ||
| 1282 | 1284 | ||
| 1283 | if (how->resolve & RESOLVE_NO_XDEV) | 1285 | if (how->resolve & RESOLVE_NO_XDEV) |
| 1284 | lookup_flags |= LOOKUP_NO_XDEV; | 1286 | lookup_flags |= LOOKUP_NO_XDEV; |
| @@ -1360,7 +1362,7 @@ static int do_sys_openat2(int dfd, const char __user *filename, · 75 unmodified lines | |||
| 1360 | if (unlikely(err)) | 1362 | if (unlikely(err)) |
| 1361 | return err; | 1363 | return err; |
| 1362 | 1364 | ||
| 1363 | CLASS(filename, name)(filename); | 1365 | CLASS(filename_flags, name)(filename, op.lookup_flags); |
| 1364 | return FD_ADD(how->flags, do_file_open(dfd, name, &op)); | 1366 | return FD_ADD(how->flags, do_file_open(dfd, name, &op)); |
| 1365 | } | 1367 | } |
| 1366 | 1368 | ||
| @@ -10,7 +10,7 @@ · 9 unmodified lines | |||
| 10 | (O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \ | 10 | (O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \ |
| 11 | O_APPEND | O_NDELAY | O_NONBLOCK | __O_SYNC | O_DSYNC | \ | 11 | O_APPEND | O_NDELAY | O_NONBLOCK | __O_SYNC | O_DSYNC | \ |
| 12 | FASYNC | O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \ | 12 | FASYNC | O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \ |
| 13 | O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE) | 13 | O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE | O_EMPTYPATH) |
| 14 | 14 | ||
| 15 | /* List of all valid flags for the how->resolve argument: */ | 15 | /* List of all valid flags for the how->resolve argument: */ |
| 16 | #define VALID_RESOLVE_FLAGS \ | 16 | #define VALID_RESOLVE_FLAGS \ |
| @@ -88,6 +88,10 @@ · 87 unmodified lines | |||
| 88 | #define __O_TMPFILE 020000000 | 88 | #define __O_TMPFILE 020000000 |
| 89 | #endif | 89 | #endif |
| 90 | 90 | ||
| 91 | #ifndef O_EMPTYPATH | ||
| 92 | #define O_EMPTYPATH (1 << 26) /* allow empty path */ | ||
| 93 | #endif | ||
| 94 | |||
| 91 | /* a horrid kludge trying to make sure that this will fail on old kernels */ | 95 | /* a horrid kludge trying to make sure that this will fail on old kernels */ |
| 92 | #define O_TMPFILE (__O_TMPFILE | O_DIRECTORY) | 96 | #define O_TMPFILE (__O_TMPFILE | O_DIRECTORY) |
| 93 | 97 | ||