d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve comment above nameicap_check_dotdot().

Browse Source 
Explain why tracker is needed at all.

Reviewed by:	markj
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D25886
This commit is contained in:
Konstantin Belousov 2020-09-22 21:54:30 +00:00
parent d458747eb2
commit 44619a5e86
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/kern/vfs_lookup.c
View File

@ -215,7 +215,11 @@ nameicap_cleanup(struct nameidata *ndp, bool clean_latch)
/*
* For dotdot lookups in capability mode, only allow the component
* lookup to succeed if the resulting directory was already traversed
* during the operation. Also fail dotdot lookups for non-local
* during the operation. This catches situations where already
* traversed directory is moved to different parent, and then we walk
* over it with dotdots.
*
* Also allow to force failure of dotdot lookups for non-local
* filesystems, where external agents might assist local lookups to
* escape the compartment.
*/