Post #1887731

2026-04-24 14:02 UTC

@JdeBP @swick openat2() with the RESOLVE_IN_ROOT would seem to cover that? Or RESOLVE_BENEATH if you just want to make sure the opened file is below dirfd without changing the meaning of absolute symlinks.

Replies (1)

@JdeBP@mastodonapp.uk 2026-04-24 20:55

@jamesh Of course no it does not. Passing the root directory and the working directory as file descriptors takes two descriptors, and openat2() only has one descriptor parameter. The idea is that application mode code explicitly passes in all of the things that would normally be internally referenced from fields in the process structure, such as the root directory, the working directory, and the user credential set. And everything then just proceeds per the #Unix namei of old. We've been frustratingly close to this for decades, and no-one has quite invented it. With it, @swick's privileged server program opens the root directory, opens the working directory, opens/receives a credentials descriptor, and then just calls the syscall with the client-supplied paths. All of the TOCTOU problems with path normalization vanish. All of the multi-client parallel sete[ug]id and chdir synchronization problems vanish. #filesystems

Open ##1887732