Re: encapsulating directory operations

On 6/2/25 11:24, Scott Lurndal wrote:

Bonita Montero <Bonita.Montero@gmail.com> writes:

Am 01.06.2025 um 09:43 schrieb Lawrence D'Oliveiro:
>

...

You need the dirfd functions to avoid certain potential security holes
on operations with symlinks.

>
Which security holes ?
>

>
The fchownat() function shall be equivalent to the chown() and lchown()
functions except in the case where path specifies a relative path. In
this case the file to be changed is determined relative to the directory
associated with the file descriptor fd instead of the current working
directory. If the access mode of the open file description associated
with the file descriptor is not O_SEARCH, the function shall check
whether directory searches are permitted using the current permissions
of the directory underlying the file descriptor. If the access mode is
O_SEARCH, the function shall not perform the check.
>
Similiter for fstatat, faccessat, fchownat, openat, readlinkat et alia.

That describes what the functions do, it doesn't explain the potential
security holes that they avoid. The hole might seem obvious to you, but
it's certainly not obvious to me - probably because writing code to
traverse directories is something I've almost never had to do.