Home page logo

bugtraq logo Bugtraq mailing list archives

Re: /proc filesystem allows bypassing directory permissions on Linux
From: psz () maths usyd edu au
Date: Wed, 28 Oct 2009 07:39:45 +1100

Tony Finch <dot () dotat at> wrote:

According to POSIX, if you open the directory with O_SEARCH then openat()
does not re-check search (+x) permissions.

My 2.6.26 kernel (or Debian lenny) does not seem to know about O_SEARCH.
But anyway... even if openat() does not re-check permissions, it should
surely fail when in fact it does not have permissions? Surely, directory
contents are not cached? Or, do you have an example (of a running OS)
where openat() succeeds without permissions?

Cheers, Paul

Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]