The Quest to Secure chown and symlinks

This just cements my conviction that file systems not having transactional operations is a huge omission nowadays. It really is time to start having file systems that are not just huge mutable spaces, and be more like proper ACID databases.<p>I hope somebody is working on it because as things are going in the last years, I&#x27;d be retired before I have the time for it.

<p><pre><code> (cd &quot;$path&quot; &amp;&amp; [ &quot;$(pwd -P)&quot; = &quot;$path&quot; ] &amp;&amp; chown -R buildkite-agent:buildkite-agent .) </code></pre> the real question though is why they&#x27;re trusting just Docker alone to isolate customers; if they want the jobs to effectively be a single user to the system, they can even use unprivileged user namespaces?

I have a small project in this approximate area:<p><a href="https:&#x2F;&#x2F;www.kylheku.com&#x2F;cgit&#x2F;safepath&#x2F;about&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.kylheku.com&#x2F;cgit&#x2F;safepath&#x2F;about&#x2F;</a><p>safepath is a function which tries to analyze whether a path is safe to use. Roughly that means that it doesn&#x27;t resolve in some way that can be controlled by another (non-root) user.<p>A something similar to this is in TXR Lisp under the name path-components-safe:<p><a href="https:&#x2F;&#x2F;www.kylheku.com&#x2F;cgit&#x2F;txr&#x2F;tree&#x2F;stdlib&#x2F;path-test.tl?hl=txr-291#n206" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.kylheku.com&#x2F;cgit&#x2F;txr&#x2F;tree&#x2F;stdlib&#x2F;path-test.tl?hl...</a>

Why do the files have bad permissions to start with?

There would traditionally been another TOCTOU is the described solution, namely hardlinks. This can often be used to get root to do something to a file it shouldn&#x27;t.<p>The trad solution is to have user writeable areas (home, vartmp, tmp) on different volumes. Some tools have options to not traverse symlinks across volumes for this and other reasons. But on modern systems you are protected by the fs.protected_hardlinks setting.<p><a href="https:&#x2F;&#x2F;wiki.alpinelinux.org&#x2F;wiki&#x2F;Sysctl.conf" rel="nofollow noreferrer">https:&#x2F;&#x2F;wiki.alpinelinux.org&#x2F;wiki&#x2F;Sysctl.conf</a>

why is it running as root anyway?<p>should probably setuid to the correct user and do the thing there instead

test -L checks if a file is a symlink; no need for realpath comparisons (which is slower)