Re: chflags -RL and symlinks pointing outside the traversal: preserve behavior or add a Capsicum guardrail?

Jitendra Bhati <[email protected]> wrote:

> Options:
>
> Keep -L as-is (path-based, not confined) - current PR behavior.
> Capsicumize -L too, and treat out-of-hierarchy symlink targets as an error.
> Capsicumize -L but keep out-of-hierarchy targets working by opening a
> descriptor for the resolved target's parent (loses most of the confinement
> benefit for -L).
>
> I lean toward (1) for this PR and revisiting -L separately, but I'd
> appreciate opinions on whether the stricter behavior is worth the
> compatibility break.

I make no comment one way or the other on capsium, or changing to openat,
but I've always thought the option to follow symbol links like this was
useless. I can never see a case where you'd want to use such an option,
and it does open potebtial security holes.

But it's not just chflags, it's the same with many commands with recursive
options (e.g. chmod and chown)

I'd also extend the same philosophy to the non-recursive versions of these
commands: '-h' should be the default for all these too, but I guess that
ship has sailed.

Cheers,
        Jamie