Conversation

Notices

1. Embed this notice
   David Chisnall (*Now with 50% more sarcasm!*) (david_chisnall@infosec.exchange)'s status on Tuesday, 07-Oct-2025 03:56:07 JST David Chisnall (*Now with 50% more sarcasm!*)

   in reply to

   • John-Mark Gurney

   @encthenet

   They were useful Capsicum, but they were originally designed to allow race-free operations when multiple processes manipulate a tree at the same time.

   This is why it's so frustrating that the C++ filesystem APIs are so terrible. They were standardised after mainstream operating systems got sensible APIs but decided to build intrinsically racy APIs instead.

   • James Morris likes this.
   • Embed this notice
     John-Mark Gurney (encthenet@flyovercountry.social)'s status on Tuesday, 07-Oct-2025 03:56:08 JST John-Mark Gurney

     Looking at the *at family of functions and I just realized that I viewed them as part of the capsicum security framework and not as part of allowing a threaded program to access relative paths from each thread's own working directory.

     This explains why absolute paths are allowed and ignores the directory fd.

     FreeBSD's openat man page explains this.

     #FreeBSD