[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [RFC PATCH v2 4/7] csu: Fix standard fds' mode

From: Adhemerval Zanella Netto
Subject: Re: [RFC PATCH v2 4/7] csu: Fix standard fds' mode
Date: Thu, 20 Apr 2023 08:47:10 -0300
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.10.0

On 19/04/23 18:16, Sergey Bugaev wrote:
> On Wed, Apr 19, 2023 at 11:45 PM Adhemerval Zanella Netto
>>>> is this really needed now? playing silly games with this fds will always 
>>>> result in silly prices.
>> My understanding of this code is to enforce that on setuid program with
>> stdin/stdout/stderr closed any operation fail.
> Yes, but is that still considered desirable / a good idea? As opposed
> to making such operations no-op successfully (opening /dev/null with
> the expected mode).

Good question, this is essentially a hardening for setsuid binaries since
opening the file in the *expected* way is not the intended behavior (even
though the C runtime expects that STDIN_FILENO, STDOUT_FILENO, and
STDERR_FILENO are in fact opened). As far I could check, this is really a 
glibc extension (both FreeBSD and OpenBSD does not seem to add such 

I am not really sure how effective is this hardening, it seems more a
development one to enforce that system daemon are spawned correctly.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]