From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/6584 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.kernel.api,gmane.comp.lib.glibc.alpha,gmane.linux.lib.musl.general Subject: Re: [musl] Re: [RFC] Possible new execveat(2) Linux syscall Date: Fri, 21 Nov 2014 09:15:25 -0500 Message-ID: <20141121141525.GY22465@brightrain.aerifal.cx> References: <20141116195246.GX22465@brightrain.aerifal.cx> <20141121101318.GG8866@infradead.org> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1416579363 15461 80.91.229.3 (21 Nov 2014 14:16:03 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Fri, 21 Nov 2014 14:16:03 +0000 (UTC) Cc: Christoph Hellwig , libc-alpha , Andrew Morton , Linux API , Andy Lutomirski , musl-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org To: David Drysdale Original-X-From: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Fri Nov 21 15:15:55 2014 Return-path: Envelope-to: glka-linux-api-wOFGN7rlS/M9smdsby/KFg@public.gmane.org Original-Received: from vger.kernel.org ([209.132.180.67]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Xrp06-00031L-NV for glka-linux-api-wOFGN7rlS/M9smdsby/KFg@public.gmane.org; Fri, 21 Nov 2014 15:15:55 +0100 Original-Received: (majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org) by vger.kernel.org via listexpand id S1755501AbaKUOPy (ORCPT ); Fri, 21 Nov 2014 09:15:54 -0500 Original-Received: from 216-12-86-13.cv.mvl.ntelos.net ([216.12.86.13]:60496 "EHLO brightrain.aerifal.cx" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755426AbaKUOPy (ORCPT ); Fri, 21 Nov 2014 09:15:54 -0500 Original-Received: from dalias by brightrain.aerifal.cx with local (Exim 3.15 #2) id 1Xrozd-00078h-00; Fri, 21 Nov 2014 14:15:25 +0000 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Precedence: bulk List-ID: X-Mailing-List: linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Xref: news.gmane.org gmane.linux.kernel.api:6294 gmane.comp.lib.glibc.alpha:46916 gmane.linux.lib.musl.general:6584 Archived-At: On Fri, Nov 21, 2014 at 01:49:35PM +0000, David Drysdale wrote: > On Fri, Nov 21, 2014 at 10:13 AM, Christoph Hellwig wrote: > > On Sun, Nov 16, 2014 at 02:52:46PM -0500, Rich Felker wrote: > >> I've been following the discussions so far and everything looks mostly > >> okay. There are still issues to be resolved with the different > >> semantics between Linux O_PATH and what POSIX requires for O_EXEC (and > >> O_SEARCH) but as long as the intent is that, once O_EXEC is defined to > >> save the permissions at the time of open and cause them to be used in > >> place of the current file permissions at the time of execveat > > > > As far as I can tell we only need the little patch below to make Linux > > O_PATH a valid O_SEARCH implementation. Rich, you said you wanted to > > look over it? > > > > For O_EXEC my interpretation is that we basically just need this new > > execveat syscall + a patch to add FMODE_EXEC and enforce it. So we > > wouldn't even need the O_PATH|3 hack. But unless someone more familar > > with the arcane details of the Posix language verifies it I'm tempted to > > give up trying to help to implent these flags :( > > I'm not particularly familiar with POSIX details either, but I thought the > O_PATH|3 hack would be needed for the interaction with O_ACCMODE -- just > using FMODE_EXEC as O_EXEC would confuse existing code that examines > (flags & O_ACCMODE). To conform to POSIX, O_ACCMODE needs to contain all the bits of O_RDONLY|O_WRONLY|O_RDWR|O_SEARCH|O_EXEC. Certainly it's possible that code compiled with an old definition of O_ACCMODE as 3 could inherit (or otherwise obtain) a file descriptor in O_SEARCH/O_EXEC mode, so it's preferable to have the low 2 bits be distinct from the existing access modes, but O_ACCMODE's definition (at least in userspace) really does need to be updated to equal O_PATH|3. > >From [1]: > "Applications shall specify exactly one of the ...five ... file access > modes ... O_EXEC / O_RDONLY / O_RDWR / O_SEARCH / O_WRONLY" > (and O_EXEC and O_SEARCH are allowed to be the same value, > as one only applies to files and the other only applies to directories). > > As O_ACCMODE is 3, there are only 4 possible access modes that work > with any existing code that checks (flags & O_ACCMODE), and 3 of the > values are taken (0=O_RDONLY, 1=O_WRONLY, 2=O_RDWR). So I > guess that's where the idea for the |3 hack comes from. 3 is also "taken" too, but it's a mostly-undocumented hack. Rich