Re: encapsulating directory operations

On 2025-06-10, Scott Lurndal <scott@slp53.sl.home> wrote:

Bonita Montero <Bonita.Montero@gmail.com> writes:

Am 03.06.2025 um 02:37 schrieb Lawrence D'Oliveiro:

On Mon, 2 Jun 2025 09:35:24 +0200, Bonita Montero wrote:
 

Am 01.06.2025 um 09:43 schrieb Lawrence D'Oliveiro:
>

On Sun, 1 Jun 2025 07:58:54 +0200, Bonita Montero wrote:

>

Sth. like this:
>
for( directory_entry const &de : recursive_directory_iterator( "\",
directory_options::follow_directory_symlink ) )
cout << de.path() << endl;

>

You need the dirfd functions to avoid certain potential security
holes on operations with symlinks.

>
Which security holes ?

 
TOCTOU.

>
That's unavoidable with directory-operations.

>
Incorrect.  The entire purpose of the POSIX *at functions are to close
those security holes.

Simply by using a path coming from an untrusted input, you have
a securty problem that no POSIX function addresses.

I seem to recall that the "at" functions are mainly motivated by
multithreading.

A process has a single working directory, inherited from a time before
threads. The "at" function can be used to defensively code file system
access in a thread, even if there is code in the process which uses
chdir.

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca