[PATCH][BZ #15763][BZ #14752] Restrict shm_open and shm_unlink to SHMDIR.

[Florian Weimer]

On 10/23/2013 02:41 PM, Ondřej Bílka wrote:

> OK now?

Sorry, I missed the NAME_MAX reference.  I don't think it's guarantueed 
to be available.  I see that it's desirable to have some upper bound to 
avoid alloca issues.  Not sure if it's okay to put in some arbitrary 
constant (1024 would be fine in my book).

> +  fd = shm_open ("/../escaped", O_RDWR | O_CREAT | O_TRUNC | O_EXCL, 0600);

This could use /../../../../../../../tmp/escaped so that the test works 
as root as well.  You could also supply O_NOFOLLOW and fail the test if 
the error is EEXIST.

-- 
Florian Weimer / Red Hat Product Security Team