Re: Openat() and fexecve() committed

On Mon, Mar 31, 2008, Kostik Belousov wrote:
> int main() {
>    int dfd = open("/tmp/foo", O_RDONLY);
>    int res;
>    
>    chmod("/tmp/foo", 0666);
>    
>    if (dfd != -1) {
>       res = openat(dfd, "bar", 0);
>       printf("OPENAT returns: %d, errno: %s\n", res, strerror(errno));
>    }
> 
> }
> 
> gives the error EACCESS on both Linux and FreeBSD, and succeeds on Solaris.
> The Solaris behaviour seems to be specified in the document cited above.
> There are arguments in support of the both observed behaviour.

Doesn't the latter behavior make it possible to bypass the usual
permission checks on open("bar") via openat(AT_FDCWD, "bar")?