Date: Sat, 10 Dec 2016 12:11:54 +0200 From: Konstantin Belousov <kostik@kib.kiev.ua> To: Conrad Meyer <cem@freebsd.org> Cc: src-committers <src-committers@freebsd.org>, svn-src-all@freebsd.org, svn-src-head@freebsd.org, emaste@freebsd.org Subject: Re: svn commit: r308212 - in head/sys: fs/nfsserver kern sys Message-ID: <20161210101154.GM54029@kib.kiev.ua> In-Reply-To: <CAG6CVpWuEMtVzyusaSpmrKazvkthN7Hi8mO7==zubhDSN=WxWg@mail.gmail.com> References: <201611021243.uA2ChGIg003295@repo.freebsd.org> <CAG6CVpWuEMtVzyusaSpmrKazvkthN7Hi8mO7==zubhDSN=WxWg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Dec 09, 2016 at 12:13:09PM -0800, Conrad Meyer wrote: > On Wed, Nov 2, 2016 at 5:43 AM, Konstantin Belousov <kib@freebsd.org> wrote: > > Author: kib > > Date: Wed Nov 2 12:43:15 2016 > > New Revision: 308212 > > URL: https://svnweb.freebsd.org/changeset/base/308212 > > > > Log: > > Allow some dotdot lookups in capability mode. > > > > If dotdot lookup does not escape from the file descriptor passed as > > the lookup root, we can allow the component traversal. Track the > > directories traversed, and check the result of dotdot lookup against > > the recorded list of the directory vnodes. > > > > Dotdot lookups are enabled by sysctl vfs.lookup_cap_dotdot, currently > > disabled by default until more verification of the approach is done. > > Hi Konstantin, > > Are we waiting on a specific reviewer or something else? It would be > very nice to have this enabled by default. I did waited for some review, but it obviously not going to happen. Please push the button for D8746, and I will commit the change.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20161210101154.GM54029>