{"id":183605,"date":"2026-10-05T10:54:21","date_gmt":"2026-10-05T08:54:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/teo-de-raadt-predlozhil-izmeneniya-dlya-ogranicheniya-dostupa-k-fs-cherez-funkcziyu-openat"},"modified":"2026-10-05T10:54:25","modified_gmt":"2026-10-05T08:54:25","slug":"theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","title":{"rendered":"Theo de Raadt v\u00e1ltoztat\u00e1sokat javasolt a f\u00e1jlrendszerhez val\u00f3 hozz\u00e1f\u00e9r\u00e9s korl\u00e1toz\u00e1s\u00e1ra az openat funkci\u00f3n kereszt\u00fcl.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Theo de Raadt javasolta, hogy az OpenBSD-be \u00faj mechanizmust kellene be\u00e9p\u00edteni a t\u00e1mad\u00e1si fel\u00fclet cs\u00f6kkent\u00e9s\u00e9re, amelyet az openat rendszerh\u00edv\u00e1s k\u00e9pess\u00e9geinek kiterjeszt\u00e9s\u00e9n kereszt\u00fcl val\u00f3s\u00edtanak meg. Az openat \u00e9s open rendszerh\u00edv\u00e1sokhoz k\u00e9sz\u00fclt tov\u00e1bbi z\u00e1szl\u00f3k implement\u00e1l\u00e1s\u00e1ra vonatkoz\u00f3 jav\u00edt\u00e1sok k\u00e9sz\u00fcltek, amelyek korl\u00e1tozz\u00e1k a lehet\u0151s\u00e9get arra, hogy f\u00e1jlokhoz a fels\u0151 k\u00f6nyvt\u00e1rakon kereszt\u00fcl l\u00e9pj\u00fcnk a \"..\/\" seg\u00edts\u00e9g\u00e9vel \u00e9s a teljes el\u00e9r\u00e9si utakat haszn\u00e1lva, ezeket a kernelhez, libc-hez, valamint n\u00e9h\u00e1ny alapszint\u0171 alkalmaz\u00e1shoz k\u00e9sz\u00edtett\u00e9k. A m\u00f3dos\u00edt\u00e1sok m\u00e9g nem r\u00e9szei az OpenBSD-current-nek, \u00e9s a fejleszt\u0151k k\u00f6z\u00f6tt folyamatban van a vita. <\/p>\n

Az openat(2) rendszerh\u00edv\u00e1s csal\u00e1d olyan, mint az open(2), kiv\u00e9ve hogy ha az 'path' param\u00e9terben relat\u00edv el\u00e9r\u00e9si utat adunk meg, akkor a megnyitott f\u00e1jl a 'fd' f\u00e1jlhivatkoz\u00f3hoz kapcsol\u00f3d\u00f3 k\u00f6nyvt\u00e1r viszonylat\u00e1ban ker\u00fcl meghat\u00e1roz\u00e1sra, nem a jelenlegi munkak\u00f6nyvt\u00e1r viszonylat\u00e1ban. Ha abszol\u00fat el\u00e9r\u00e9si utat adunk \u00e1t az openat-nak, p\u00e9ld\u00e1ul: int dirfd = open(\"\/tmp\", O_RDONLY | O_DIRECTORY); int hfd = openat(dirfd, \"\/etc\/hosts\", O_RDONLY); <\/p>\n

Az openat() funkci\u00f3 figyelmen k\u00edv\u00fcl hagyja a 'dirfd'-t, \u00e9s ennek k\u00f6vetkezt\u00e9ben az abszol\u00fat el\u00e9r\u00e9si utat a szok\u00e1sos m\u00f3don kezelik. <\/p>\n

Therefore, replacing open() with openat() does not, in itself, enhance the security of the program. Such a call may speed up path resolution, but does not limit access to the filesystem. Flags that prohibit absolute paths (for example, RESOLVE_BENEATH and\/or RESOLVE_IN_ROOT for openat2 in Linux) do not guarantee protection: the programmer must add them to all suitable calls, and if the attacker gains control of the process, they may exploit other ways to open files. <\/p>\n

While working on the openrsync utility, The\u00f3 found it necessary to limit its capabilities for traversing the filesystem, but it was not possible to do this using unveil() and pledge() functions. This led to the idea of a mechanism similar to openat(), but with security properties complementing pledge\/unveil or even functioning in their absence. <\/p>\n

A f\u0151 \u00f6tlet \u2014 hogy a korl\u00e1toz\u00e1sokat a k\u00f6nyvt\u00e1r deszkriptor\u00e1nak r\u00e9sz\u00e9v\u00e9 tegy\u00fck. Ehhez F_BELOW z\u00e1szl\u00f3t javasolnak, amelyet a fcntl() seg\u00edts\u00e9g\u00e9vel lehet be\u00e1ll\u00edtani, vagy O_BELOW z\u00e1szl\u00f3t az open() eset\u00e9ben. A \u00edgy korl\u00e1tozott 'dirfd' deszkriptor csak a k\u00f6nyvt\u00e1rf\u00e1k lefel\u00e9 t\u00f6rt\u00e9n\u0151 l\u00e9p\u00e9seit enged\u00e9lyezi: az openat() h\u00edv\u00e1sok abszol\u00fat el\u00e9r\u00e9si \u00fattal vagy \"..\"-on kereszt\u00fcli l\u00e9p\u00e9sekkel hib\u00e1val, ENOENT-tel z\u00e1rulnak. A k\u00f3d v\u00e9grehajt\u00e1s\u00e1hoz vezet\u0151 t\u00e1mad\u00e1s eset\u00e9n a folyamat f\u00e1jl deszkriptora kevesebb funkcion\u00e1lis 'dirfd'-t fog tartalmazni, ami korl\u00e1tozza a t\u00e1mad\u00e1si fel\u00fcletet.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u0435\u043e \u0434\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0432 OpenBSD \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u043b\u044f \u0443\u043c\u0435\u043d\u044c\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 openat. \u041f\u0430\u0442\u0447\u0438 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u043b\u0430\u0433\u043e\u0432 \u0434\u043b\u044f openat \u0438 open, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043a \u0432\u0435\u0440\u0445\u043d\u0438\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c \u0447\u0435\u0440\u0435\u0437 «\/..» \u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u044b\u043c \u043f\u0443\u0442\u044f\u043c, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u0434\u043b\u044f \u044f\u0434\u0440\u0430, libc, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438\u0437 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183605","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Theo de Raadt m\u00f3dos\u00edt\u00e1sokat javasolt a f\u00e1jlrendszerhez val\u00f3 hozz\u00e1f\u00e9r\u00e9s korl\u00e1toz\u00e1s\u00e1ra az openat f\u00fcggv\u00e9nyen kereszt\u00fcl | ProHoster","description":"Theo de Raadt javasolta, hogy az OpenBSD-be \u00faj mechanizmust \u00e9p\u00edtsenek be a t\u00e1mad\u00e1si fel\u00fclet cs\u00f6kkent\u00e9s\u00e9re, amely az openat rendszerh\u00edv\u00e1s k\u00e9pess\u00e9geinek kiterjeszt\u00e9s\u00e9n kereszt\u00fcl val\u00f3sul meg.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0435\u043e \u0434\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0424\u0421 \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e openat | ProHoster","og:description":"\u0422\u0435\u043e \u0434\u0435 \u0420\u0430\u0430\u0434\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0432 OpenBSD \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0434\u043b\u044f \u0443\u043c\u0435\u043d\u044c\u0448\u0435\u043d\u0438\u044f \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 openat.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-05T08:54:21+00:00","article:modified_time":"2026-10-05T08:54:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/183605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=183605"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/183605\/revisions"}],"predecessor-version":[{"id":183606,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/183605\/revisions\/183606"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=183605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=183605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=183605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}