oss-sec mailing list archives

O_CREAT|O_DIRECTORY on nonexisting file expected behaviour?


From: Fiedler Roman <Roman.Fiedler () ait ac at>
Date: Wed, 26 Nov 2014 13:45:42 +0000

Hello,

While trying to write a small python helper library for secure opening of
files, I found behaviour of following call unexpected because it created a
file instead of creating/failing in opening a directory:

open("xxx", O_RDONLY|O_CREAT|O_DIRECTORY, 0600) = 3

I call it unexpected, because man-page mentioned:

       O_DIRECTORY
              If pathname is not a directory, cause the open  to  fail.
This
              flag is Linux-specific, and was added in kernel version
2.1.126,
              to avoid denial-of-service problems if opendir(3) is called on
a
              FIFO or tape device.

The only topic I found dealing with such issue was [1].

Is the man page just wrong or what would be the correct behaviour of that
call? Is it likely, that some other tool could also end up with that,
illogic combination of flags, thus creating a file instead of opening a
directory?

Or perhaps to use it to escape syscall auditing if creation of files with
special flags would be monitored but directory creation is not?

[1] https://lkml.org/lkml/2005/9/23/166

DI Roman Fiedler
Scientist
Safety & Security Department
Assistive Healthcare Information Technology

AIT Austrian Institute of Technology GmbH
Reininghausstraße 13/1 | 8020 Graz | Austria
T +43(0) 50550 2957 | M +43(0) 664 8561599 | F +43(0) 50550 2950
roman.fiedler () ait ac at | http://www.ait.ac.at/

FN: 115980 i HG Wien  |  UID: ATU14703506
http://www.ait.ac.at/Email-Disclaimer

Attachment: smime.p7s
Description:


Current thread: