Should unprivileged linkat(..., AT_EMPTY_PATH) work on O_TMPFILE files?
From: Andy Lutomirski
Date: Thu Jul 25 2013 - 21:57:16 EST
Author: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Date: Tue Jun 11 08:34:36 2013 +0400
allow the temp files created by open() to be linked to
O_TMPFILE | O_CREAT => linkat() with AT_SYMLINK_FOLLOW and /proc/self/fd/<n>
as oldpath (i.e. flink()) will create a link
O_TMPFILE | O_CREAT | O_EXCL => ENOENT on attempt to link those guys
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
makes it possible to hardlink an O_TMPFILE file using procfs. Should
linkat(fd, "", newdirfd, newpath, AT_EMPTY_PATH) also work?
AFAICS it currently requires CAP_DAC_READ_SEARCH, but I'm a bit
confused as to why linkat(..., AT_EMPTY_PATH) should have a stricter
check than linkat(AT_FDCWD, "/proc/self/fd/n", ...,
AT_SYMLINK_FOLLOW), (The relevant change is
FWIW, this program works on Linux 3.9, which makes me doubt that the
security restriction on linkat is doing any good:
int main(int argc, char **argv)
if (argc != 3)
errx(1, "Usage: flink FD PATH");
sprintf(buf, "/proc/self/fd/%d", atoi(argv));
if (linkat(AT_FDCWD, buf, AT_FDCWD, argv, AT_SYMLINK_FOLLOW) != 0)
Removing the check from the AT_EMPTY_PATH case would simplify code
that wants to write a file, fsync it, and then flink it in.
P.S. For even more fun, I'd *love* a linkat flag that would allow the
destination to be overwritten, but that's a different can of worms.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/