{"id":183605,"date":"2026-10-05T10:54:21","date_gmt":"2026-10-05T08:54:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/teo-de-raadt-predlozhil-izmeneniya-dlya-ogranicheniya-dostupa-k-fs-cherez-funkcziyu-openat"},"modified":"2026-10-05T10:54:25","modified_gmt":"2026-10-05T08:54:25","slug":"theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","title":{"rendered":"Teo de Raadt pakkus v\u00e4lja muudatused, et piirata juurdep\u00e4\u00e4su FS-ile openat funktsiooni kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Theo de Raadt on soovitanud lisada OpenBSD-sse uue mehhanismi r\u00fcnde pinna v\u00e4hendamiseks, mille on ellu viidud s\u00fcsteemi kutsumise openat laiendamise kaudu. Patchid, mis sisaldavad openat ja open t\u00e4iendavaid lippude rakendusi, mis piiravad v\u00f5imalust minna \u00fclemistesse kataloogidesse l\u00e4bi \u00ab\/..\u00bb ja p\u00f6\u00f6rdumist absoluutsete teede poole, on ette valmistatud tuumale, libc-le ja m\u00f5nedele rakendustele p\u00f5hikogus. Muudatused pole veel lisatud OpenBSD-currenti ja need on arutelu all arendajate seas. <\/p>\n
Openat(2) s\u00fcsteemi kutsete perekond t\u00f6\u00f6tab nagu open(2), v\u00e4lja arvatud see, et kui parameetris \u00abpath\u00bb on m\u00e4\u00e4ratud suhteline tee, siis avatud fail m\u00e4\u00e4ratakse faili descriptoriga \u00abfd\u00bb seotud katalooge osas, mitte praeguse t\u00f6\u00f6 katalooge osas. Kui openat-ile edastada absoluutne tee, n\u00e4iteks: int dirfd = open(\u00ab\/tmp\u00bb, O_RDONLY | O_DIRECTORY); int hfd = openat(dirfd, \u00ab\/etc\/hosts\u00bb, O_RDONLY); <\/p>\n
funktsioon openat() ignoreerib \u00abdirfd\u00bb ja seet\u00f5ttu t\u00f6\u00f6deldakse absoluutset teed tavalise viisi j\u00e4rgi. <\/p>\n
Therefore, replacing open() with openat() does not enhance program security by itself. Such a call may speed up path parsing but does not restrict access to the filesystem. Flags that prohibit absolute paths (for example, RESOLVE_BENEATH and\/or RESOLVE_IN_ROOT for openat2 in Linux) do not guarantee protection: the programmer must add them to all relevant calls, and if the process control is compromised, the attacker may take advantage of other methods to open files. <\/p>\n
During the work on the openrsync utility, Theo found a need to limit its ability to traverse the filesystem, but doing so with the unveil() and pledge() functions proved impossible. Thus, the idea of a mechanism similar to openat() arose, but with security properties that complement pledge\/unveil or even work in their absence. <\/p>\n
Peamine idee \u2014 teha piirangud s\u00f5lme enda jaoks. Selleks pakutakse v\u00e4lja lipp F_BELOW, mille saab seadistada funktsiooni fcntl() kaudu, v\u00f5i lipp O_BELOW open() jaoks. Sellises piiratud olekus \u00abdirfd\u00bb faili descriptor lubab ainult allapoole liikuda kataloogipuus: openat() kutseid absoluutse tee v\u00f5i \u00ab..\u00bb kaudu \u00fcleminekul l\u00f5petatakse ENOENT veaga. R\u00fcnnaku korral, mis viib koodi t\u00e4itmiseni, sisaldab protsessi failide descriptorite tabel v\u00e4hem funktsionaalseid \u00abdirfd\u00bb, mis piirab r\u00fcnde pinda. \n Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"