{"id":183605,"date":"2026-10-05T10:54:21","date_gmt":"2026-10-05T08:54:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/teo-de-raadt-predlozhil-izmeneniya-dlya-ogranicheniya-dostupa-k-fs-cherez-funkcziyu-openat"},"modified":"2026-10-05T10:54:25","modified_gmt":"2026-10-05T08:54:25","slug":"theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/theo-de-raadt-proposed-changes-to-restrict-filesystem-access-via-openat","title":{"rendered":"Teo de Raad je predlo\u017eio izmene za ograni\u010davanje pristupa FS putem funkcije openat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Teo de Raadt je predlo\u017eil vklju\u010ditev novega mehanizma v OpenBSD, ki zmanj\u0161uje napadno povr\u0161ino in je realiziran preko raz\u0161iritve funkcionalnosti sistemskega klica openat. Popravki za implementacijo dodatnih zastavic za openat in open, ki omejujejo mo\u017enost prehoda v zgornje mape preko \"..\/\" in dostopa do absolutnih poti, so pripravljeni za jedro, libc in nekatere aplikacije iz osnovnega sistema. Spremembe \u0161e niso vklju\u010dene v OpenBSD-current in so v fazi razprave med razvijalci. <\/p>\n
Dru\u017eina sistemskih klicev openat(2) deluje kot analog open(2), razen tega, da se, \u010de je v parametru \"path\" navedena relativna pot, odprt dokument dolo\u010di relativno do mape, povezane z razpolo\u017eljivim opisovalcem datotek \"fd\", namesto konec dela. \u010ce se openat prenese absolutno pot, na primer: int dirfd = open(\"\/tmp\", O_RDONLY | O_DIRECTORY); int hfd = openat(dirfd, \"\/etc\/hosts\", O_RDONLY); <\/p>\n
funkcija openat() bo ignorirala \"dirfd\" in posledi\u010dno se bo absolutna pot obdelala na obi\u010dajen na\u010din. <\/p>\n
Therefore, replacing open() with openat() does not, by itself, enhance the security of the program. Such a call can speed up path resolution but does not limit access to the filesystem. The flags preventing absolute paths (e.g., RESOLVE_BENEATH and\/or RESOLVE_IN_ROOT for openat2 in Linux) do not guarantee protection: the programmer must add them to all appropriate calls, and if the attacker takes control of the process, they can exploit other paths for opening files. <\/p>\n
During the work on the openrsync utility, Theo encountered the need to limit its capabilities for traversing the filesystem, but it was not possible to do this using the unveil() and pledge() functions. Thus, the idea arose for a mechanism similar to openat(), but with security properties that complement pledge\/unveil or even function in their absence. <\/p>\n
Osnovna ideja je, da postane omejitve del samega opisovalca mape. Za to se predlaga zastavica F_BELOW, ki jo je mogo\u010de nastaviti preko fcntl(), ali zastavica O_BELOW za open(). Omejen opisovalec \"dirfd\" bo dovoljeval le prehode navzdol po drevesu map: klici openat() z absolutno potjo ali s prehodom navzgor preko \"..\" se bodo zaklju\u010dili z napako ENOENT. V primeru napada, ki vodi do izvr\u0161itve kode, bo tabela datote\u010dnih opisovalcev postopka vsebovala manj funkcionalne \"dirfd\", kar bo omejilo napadno povr\u0161ino. \n Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"