Re: Vixie/ISC Cron group crontab to root escalation

[Fiedler Roman <Roman.Fiedler () ait ac at>]

> Von: Florian Weimer [mailto:fweimer () redhat com]
>
> On 06/13/2017 02:32 PM, Fiedler Roman wrote:
> > Well, partially: what O_PATH can do, you could also do before O_PATH
> using
> > repeated single-level open(NO_FOLLOW)/fstat-checks. So you had to do
> all the
> > verification by yourself.
>
> That's not completely accurate because open/close on device nodes can
> have side effects (the classic example is a rewinding tape device).
> O_PATH gives you an opportunity to perform these policy checks before
> the side effect happens.

So true, I know about this case. But my initial messages was not intended to 
compare subtle differences O_PATH with other OS file access functionality 
already available but - prove me wrong - to argue for extending open 
functionality in general using features O_PATH to my knowledge cannot provide. 
But all that content was removed in the first reply to the message.

LG Roman

Attachment: smime.p7s
Description: