Date: Fri, 9 Dec 2016 12:13:09 -0800 From: Conrad Meyer <cem@freebsd.org> To: Konstantin Belousov <kib@freebsd.org> Cc: src-committers <src-committers@freebsd.org>, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r308212 - in head/sys: fs/nfsserver kern sys Message-ID: <CAG6CVpWuEMtVzyusaSpmrKazvkthN7Hi8mO7==zubhDSN=WxWg@mail.gmail.com> In-Reply-To: <201611021243.uA2ChGIg003295@repo.freebsd.org> References: <201611021243.uA2ChGIg003295@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 2, 2016 at 5:43 AM, Konstantin Belousov <kib@freebsd.org> wrote: > Author: kib > Date: Wed Nov 2 12:43:15 2016 > New Revision: 308212 > URL: https://svnweb.freebsd.org/changeset/base/308212 > > Log: > Allow some dotdot lookups in capability mode. > > If dotdot lookup does not escape from the file descriptor passed as > the lookup root, we can allow the component traversal. Track the > directories traversed, and check the result of dotdot lookup against > the recorded list of the directory vnodes. > > Dotdot lookups are enabled by sysctl vfs.lookup_cap_dotdot, currently > disabled by default until more verification of the approach is done. Hi Konstantin, Are we waiting on a specific reviewer or something else? It would be very nice to have this enabled by default. Thanks, Conrad
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAG6CVpWuEMtVzyusaSpmrKazvkthN7Hi8mO7==zubhDSN=WxWg>