[Bug libc/27454] New: Wrong flags check in sysdeps/posix/fdopendir.c for dfd opened with O_PATH

[Bug libc/27454] New: Wrong flags check in sysdeps/posix/fdopendir.c for dfd opened with O_PATH

[bugs at claycon dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27454

            Bug ID: 27454
           Summary: Wrong flags check in sysdeps/posix/fdopendir.c for dfd
                    opened with O_PATH
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: bugs at claycon dot org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

fdopendir is documented to return EINVAL if the fd is not readable.
It tests for this using:
  if (__glibc_unlikely ((flags & O_ACCMODE) == O_WRONLY))

However, if the fd is opened with O_PATH, that will not detect unreadable.

Possible fix:
  if (__glibc_unlikely (((flags & O_ACCMODE) == O_WRONLY) || (flags & O_PATH)))

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27454] Wrong flags check in sysdeps/posix/fdopendir.c for dfd opened with O_PATH

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27454

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-
                 CC|                            |fweimer at redhat dot com

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Just to be clear here, you want fdopendir to fail if the descriptor has been
opened using O_PATH? Thanks.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27454] Wrong flags check in sysdeps/posix/fdopendir.c for dfd opened with O_PATH

[bugs at claycon dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27454

--- Comment #2 from Clay Harris <bugs at claycon dot org> ---
Correct.

Even though readdir will fail later in the O_PATH case, the expected
behavior is that fdopendir ought to catch that the dfd is unreadable.

There could be a fallback for O_PATH where fdopendir attempts to
open /proc/self/fd/<dfd> for O_RDONLY.  If successful, it would
immediately close dfd and use the new fd instead.  But, this seems
like overkill to me.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27454] Wrong flags check in sysdeps/posix/fdopendir.c for dfd opened with O_PATH

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27454

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
Okay, getdents64 indeed fails with EBADF for O_PATH descriptors. I agree it
makes sense to catch this earlier.

-- 
You are receiving this mail because:
You are on the CC list for the bug.