rmdir(2) behavior to prevent pax(1) from working
----Security_Multipart(Mon_Dec_27_23_53_58_2004_708)--
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hi,
I notice that the current rmdir(2) implementation allows
rmdir(2) to remove a directory path whose final component is
either "." or ".." (such as /tmp/foo/bar/.).
This sounds no problem, but the pax(1) utility depends on this
behavior at least. Try the following commands:
% cd /tmp
% mkdir a b
% touch a/foo
% cd a
% pax -r -w . ../b
In this case pax(1) should go into a infinite loop.
The SUSv3 also says "If the path argument refers to a path
whose final component is either dot or dot-dot, rmdir() shall fail."
so I think it is better to be fixed.
Probably kern_rmdir() @ sys/kern/vfs_syscalls.c needs
some sort of sanity check for the trailing "." and "..",
but unfortunately I have no idea about a concrete solution because
I am not familiar with the new VFS/namecache API...
Could anyone investigate this problem?
--
| Hiroki SATO
----Security_Multipart(Mon_Dec_27_23_53_58_2004_708)--
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
iD8DBQBB0CIITyzT2CeTzy0RAiYSAKCT9G6aWmHtbJNYZZuOy9bz0Ov+MgCgx0G1
Hhjdd6rtsl2XcLXI6YDdBcM=
=9vIa
-----END PGP SIGNATURE-----
----Security_Multipart(Mon_Dec_27_23_53_58_2004_708)----
討論串 (同標題文章)