Theó de Raadt proposed to include a new mechanism in OpenBSD to reduce the attack surface, implemented through an extension of the openat system call capabilities. Patches with the implementation of additional flags for openat and open, limiting the ability to traverse to upper directories through "../" and to access absolute paths, have been prepared for the kernel, libc, and some applications from the base system. The changes are not yet included in OpenBSD-current and are under discussion among developers.
The family of system calls openat(2) works as an analog to open(2), except that if a relative path is specified in the "path" parameter, the file being opened is determined relative to the directory associated with the file descriptor "fd", rather than the current working directory. If an absolute path is passed to openat, for example: int dirfd = open("/tmp", O_RDONLY | O_DIRECTORY); int hfd = openat(dirfd, "/etc/hosts", O_RDONLY);
The function openat() will ignore "dirfd" and consequently, the absolute path will be processed in the usual way.
Therefore, replacing open() with openat() does not, in itself, enhance the security of the program. Such a call may speed up path resolution, but does not limit access to the filesystem. Flags that prohibit absolute paths (for example, RESOLVE_BENEATH and/or RESOLVE_IN_ROOT for openat2 in Linux) do not guarantee protection: the programmer must add them to all suitable calls, and if the attacker gains control of the process, they may exploit other ways to open files.
While working on the openrsync utility, Theó found it necessary to limit its capabilities for traversing the filesystem, but it was not possible to do this using unveil() and pledge() functions. This led to the idea of a mechanism similar to openat(), but with security properties complementing pledge/unveil or even functioning in their absence.
A fő elképzelés az, hogy a korlátozásokat a könyvtár leírójának részévé tegyük. Ehhez javasolják az F_BELOW zászlót, amelyet a fcntl() segítségével be lehet állítani, vagy az O_BELOW zászlót az open() számára. Az így korlátozott "dirfd" leíró csak lefelé engedi a könyvtárfákban történő navigációt: az openat() hívások abszolút úttal vagy a «..» segítségével felfelé történő navigálással hibát, ENOENT-t eredményeznek. Ha olyan támadás történik, amely kódvégrehajtáshoz vezet, a folyamat fájl leíró táblája kevesebb funkcióval rendelkező "dirfd"-kat tartalmaz, ami korlátozza a támadási felületet.
Forrás: opennet.ru
