Messages in this thread | | | Date | Mon, 7 Aug 2006 18:56:42 -0400 | From | Daniel Jacobowitz <> | Subject | Re: [RFC/PATCH] revoke/frevoke system calls V2 |
| |
On Mon, Aug 07, 2006 at 10:52:59PM +0000, David Wagner wrote: > I'm still trying to understand the semantics of this proposed > frevoke() implementation. Can an attacker use this to forcibly > close some other processes' file descriptor? Suppose the target > process has fd 0 open and the attacker revokes the file corresponding > to fd 0; what is the state of fd 0 in the target process? Is it > closed? If the target process then open()s another file, does it > get bound to fd 0? (Recall that open() always binds to the lowest > unused fd.) If the answers are "yes", then the security consequences > seem very scary.
No, that's already been answered at least once. The file remains open, but returns EBADF on various operations.
-- Daniel Jacobowitz CodeSourcery - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |