From patchwork Thu Aug 13 09:32:46 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Drysdale X-Patchwork-Id: 7007131 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id B0B2BC05AC for ; Thu, 13 Aug 2015 09:33:13 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id CE33A20263 for ; Thu, 13 Aug 2015 09:33:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1F6D120357 for ; Thu, 13 Aug 2015 09:33:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752118AbbHMJdH (ORCPT ); Thu, 13 Aug 2015 05:33:07 -0400 Received: from mail-wi0-f169.google.com ([209.85.212.169]:35535 "EHLO mail-wi0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752754AbbHMJc7 (ORCPT ); Thu, 13 Aug 2015 05:32:59 -0400 Received: by wicne3 with SMTP id ne3so131884659wic.0 for ; Thu, 13 Aug 2015 02:32:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=z6uE+ZvouD9XauLioJ9w3TDhz6R0QRp/1UTIc6lha80=; b=fOGHP2CAeFlu4+OyNx38GFbPMX2Xg0v8DP031dd3ZtW6zC14n5k01pQVQoIZJZJAVv 6Zhq4YZeXQf4AqnSoy80JkvYf8zhvyfVQXBpL1khTWjHrqXt4RXfURZWqmZTXt05vzQM AYwsooGZOjmk3Hv7kWbKUEpO7tWNWdsc641I/QkTgsZCXTyZX5GQV0IgoVLRmcdBEal1 q6VeFo3i7kJR58XneFFi0Ayrje2xhAxLmw9tkrNGEP8bk50XofgpFalGXMSVqsQqqrPA flAhwPbSCs+ErSe0DZLLpw+GaWeFgXprrQZxMDTkzzv60dHByIR5Cr5eL1DjLz2Qq0c3 mQyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=z6uE+ZvouD9XauLioJ9w3TDhz6R0QRp/1UTIc6lha80=; b=lLo1Ja7/IXjoiJuBb7mGFQDu6egfJYHKydooR/TQsRGAVYdR5436Ct+zl3+BR8mWYm kswzfKnbww6+QuZ1DupUv+Xfko/qpdPPtaVuhl6qqouBNQ0spxkqfZn1KqpXhOYMVUPM L47UsJqSuMHQUxdDmWUqIkTv5KoT2UJoll0wxe2WTw+8WTs9ZhW9MmtoOwSb01VoPYf6 jdQFxUXEZNAGv/zaCu1Di0js9zg2FvyZk/sbNxlfIiFtCMvScCYiR8/GHRzoKT0Bakjz CJKaJd/NQiwHDc2AirD/HbCe+q5Ll0KRSmpZQwV/BQuRpLAGPEc0AvDC4tomMR7buMU0 DORQ== X-Gm-Message-State: ALoCoQmvmSw81Tx5Z62UZIdfmLdVcs9uOkBq3RX0FEa7BFuhYQL9kDrLQmdQfvEyIqIl/BpnnZ9K X-Received: by 10.180.88.196 with SMTP id bi4mr58072939wib.70.1439458377898; Thu, 13 Aug 2015 02:32:57 -0700 (PDT) Received: from localhost.localdomain ([74.125.61.146]) by smtp.gmail.com with ESMTPSA id jr5sm2439204wjc.14.2015.08.13.02.32.55 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 13 Aug 2015 02:32:57 -0700 (PDT) From: David Drysdale To: linux-kernel@vger.kernel.org, Alexander Viro , Kees Cook , "Eric W. Biederman" Cc: Greg Kroah-Hartman , Meredydd Luff , Will Drewry , Jorge Lucangeli Obes , Ricky Zhou , Lee Campbell , Julien Tinnes , Mike Depinet , James Morris , Andy Lutomirski , Paolo Bonzini , Paul Moore , Christoph Hellwig , Michael Kerrisk , Dave Chinner , linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, fstests@vger.kernel.org, David Drysdale Subject: [PATCHv4 man-pages 3/3] open.2: describe O_BENEATH flag Date: Thu, 13 Aug 2015 10:32:46 +0100 Message-Id: <1439458366-8223-4-git-send-email-drysdale@google.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1439458366-8223-1-git-send-email-drysdale@google.com> References: <1439458366-8223-1-git-send-email-drysdale@google.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Signed-off-by: David Drysdale --- man2/open.2 | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) -- 2.5.0.rc2.392.g76e840b -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/man2/open.2 b/man2/open.2 index f49ab3042161..d09511f9ffb0 100644 --- a/man2/open.2 +++ b/man2/open.2 @@ -201,6 +201,43 @@ See for further details. See also BUGS, below. .TP +.B O_BENEATH " (since Linux 4.??)" +Ensure that the +.I pathname +is beneath the current working directory (for +.BR open (2)) +or the +.I dirfd +(for +.BR openat (2)). +If the +.I pathname +is absolute or contains a path component of "..", the +.BR open () +fails with the error +.BR EPERM. +This occurs even if ".." path component would not actually +escape the original directory; for example, a +.I pathname +of "subdir/../filename" would be rejected. +Path components that are symbolic links to absolute paths, or that are +relative paths containing a ".." component, will also cause the +.BR open () +operation to fail with the error +.BR EPERM. + +This feature allows applications to be sure that the opened file is +within the specified directory, regardless of the original source of the +.I pathname +argument. +Some security-conscious programs may further ensure +this by imposing a system call filter (with +.BR seccomp (2)) +that requires this flag for all +.BR open () +operations, so that the program cannot open files outside of +specified directories even if subverted. +.TP .BR O_CLOEXEC " (since Linux 2.6.23)" .\" NOTE! several other man pages refer to this text Enable the close-on-exec flag for the new file descriptor. @@ -1015,6 +1052,13 @@ did not match the owner of the file and the caller was not privileged The operation was prevented by a file seal; see .BR fcntl (2). .TP +.B EPERM +The +.B O_BENEATH +flag was specified and the +.I pathname +was not beneath the relevant directory. +.TP .B EROFS .I pathname refers to a file on a read-only filesystem and write access was