From: NeilBrown The vfs_open() call misses permission checks which should happen before an open is attempted (atomic_open does separate permission checks). Much of the code in do_open() will have no effect as relevant LOOKUP_ flags aren't set. truncation will be done (which nfsd is not expected to use) along with some audit logs and security hook. The important benefit is getting the may_open() check. Signed-off-by: NeilBrown --- fs/namei.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/namei.c b/fs/namei.c index ba3e7e4b5fdb..8ef2d44b6108 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -4604,6 +4604,9 @@ out_dput: goto out; } +static int do_open(struct nameidata *nd, + struct file *file, const struct open_flags *op); + /** * vfs_lookup_open - open and possibly create a regular file * @parent: directory to contain file @@ -4660,6 +4663,9 @@ struct file *vfs_lookup_open(struct path *parent, struct qstr *last, } op.open_flag = open_flag; op.mode = mode; + op.acc_mode = ACC_MODE(open_flag); + if (open_flag & O_TRUNC) + op.acc_mode |= MAY_WRITE; dentry = lookup_open(&nd, file, &op); if (IS_ERR(dentry)) @@ -4677,7 +4683,7 @@ struct file *vfs_lookup_open(struct path *parent, struct qstr *last, error = -ELOOP; } else if (!(file->f_mode & FMODE_OPENED)) { nd.path.dentry = dentry; - error = vfs_open(&nd.path, file); + error = do_open(&nd, file, &op); } dput(dentry); -- 2.50.0.107.gf914562f5916.dirty