Re: Vixie/ISC Cron group crontab to root escalation

[Fiedler Roman <Roman.Fiedler () ait ac at>]

> From: Jakub Wilk [mailto:jwilk () jwilk net]
>
> * Fiedler Roman <Roman.Fiedler () ait ac at>, 2017-06-13, 07:45:
> > > > Thanks, perhaps a comment in the code can't hurt...
> > > > Or even O_NODEV which does not exist, or O_PATH (linux only)..
> > >
> > > As there is a O_DIRECTORY it would be more orthogonal to have
> O_REGULAR (open
> > > only a regular file). But that becomes more and more icky as we're
> running
> > > out of 32 bits of O_*)
> >
> > Why not stop that at all and have an O_POLICY,
>
> With help of O_PATH, you can implement almost any sanity check in
> userspace.
> No need to reinvent this particular wheel.

Well, partially: what O_PATH can do, you could also do before O_PATH using 
repeated single-level open(NO_FOLLOW)/fstat-checks. So you had to do all the 
verification by yourself. fts [1] does that the same in a secure manner. But 
often implementation was too complex using syscalls or not easy to do using 
the library, so not many programmers did it. The resulting programs were more 
prone to be vulnerable.

With O_PATH/fts und own fstat calls, you can also do all the things mentioned 
above, but again, I fear, not many will use them, there for convenience 
syscalls/libraries should help out.

So decision could be a) do nothing, b) blow up libc or c) blow up syscall 
interface. Specific libraries or programming best practices might not be easy 
enough to be applied.

LG Roman

[1] https://www.freebsd.org/cgi/man.cgi?query=fts&sektion=3

Attachment: smime.p7s
Description: