Add a new file descriptor sentinel FD_FAILFS_ROOT following FD_PIDFS_ROOT and FD_NSFS_ROOT and teach fchdir() to accept it. A process calling fchdir(FD_FAILFS_ROOT) moves its working directory into failfs. Every AT_FDCWD-relative lookup afterwards fails with EOPNOTSUPP including "." and ".." and getcwd() reports the working directory as unreachable from the process root by returning a path prefixed with "(unreachable)". Lookups relative to explicit directory file descriptors are unaffected. The sentinel is the only way in. No privilege or gating is required. Setting the working directory to a directory in which every operation fails grants nothing and loses nothing that closing file descriptors couldn't lose. An unlinked working directory behaves the same way today modulo errno. The working directory also plays no role in confining ".." resolution so no boundary is weakened.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -124,6 +124,7 @@ struct delegation { · 123 unmodified lines | |||
| 124 | 124 | ||
| 125 | #define FD_PIDFS_ROOT -10002 /* Root of the pidfs filesystem */ | 125 | #define FD_PIDFS_ROOT -10002 /* Root of the pidfs filesystem */ |
| 126 | #define FD_NSFS_ROOT -10003 /* Root of the nsfs filesystem */ | 126 | #define FD_NSFS_ROOT -10003 /* Root of the nsfs filesystem */ |
| 127 | #define FD_FAILFS_ROOT -10004 /* Root of the failfs filesystem */ | ||
| 127 | #define FD_INVALID -10009 /* Invalid file descriptor: -10000 - EBADF = -10009 */ | 128 | #define FD_INVALID -10009 /* Invalid file descriptor: -10000 - EBADF = -10009 */ |
| 128 | 129 | ||
| 129 | /* Generic flags for the *at(2) family of syscalls. */ | 130 | /* Generic flags for the *at(2) family of syscalls. */ |