<story><title>Dot Dot Considered Harmful</title><url>https://fuchsia.googlesource.com/docs/+/HEAD/the-book/dotdot.md</url></story><parent_chain><item><author>delinka</author><text>&amp;gt;If a handle is provided to a directory, it should imply access to resources within that directory (and additionally, their subdirectories).&lt;p&gt;Maybe within Fuschia, but not in my UNIXy systems. All users on a system need r-x on &amp;#x2F;Users, but that doesn&amp;#x27;t give them r-x on every user&amp;#x27;s home directory located as a subdirectoy of &amp;#x2F;Users - a handle acquired by bob to &amp;#x2F;Users does not imply access to &amp;#x2F;Users&amp;#x2F;delinka.&lt;p&gt;Further, if your process is treating &amp;#x27;..&amp;#x27; as a subdirectory, you&amp;#x27;re doing it wrong. Paths must be normalized (e.g. ~ expanded, . and .. resolved) before requesting a handle via absolute path.&lt;p&gt;Lastly, this document reads as if knowing a full path grants access to that path and its subdirectories. If that&amp;#x27;s the case ... oy.</text></item></parent_chain><comment><author>wahern</author><text>&amp;gt; Further, if your process is treating &amp;#x27;..&amp;#x27; as a subdirectory, you&amp;#x27;re doing it wrong. Paths must be normalized (e.g. ~ expanded, . and .. resolved) before requesting a handle via absolute path.&lt;p&gt;&amp;quot;..&amp;quot; is required for atomic traversal (similar to symlinks), which is important in some situations, such as making sure a file tree you&amp;#x27;ve descended isn&amp;#x27;t removed out from under you in a way that breaks your state. (The directory itself can be moved while you hold the handle, but the important thing is that being able to rely on &amp;quot;..&amp;quot; permits certain algorithms that are safer and more consistent.) Canonicalizing paths introduces race conditions between canonicalization and actual access, which is why this is performed in the kernel.&lt;p&gt;Canonicalizing paths makes sense if you&amp;#x27;re accepting paths from untrusted sources and you cannot make use of POSIX openat() + extensions like O_BENEATH. HTTP GET requests are supposed to be idempotent, anyhow, so there shouldn&amp;#x27;t exist any sort of race condition as a conceptual matter.&lt;p&gt;But in regular software, it&amp;#x27;s better to just pass paths as-is. The shell performs &amp;quot;~&amp;quot; expansion, but it doesn&amp;#x27;t resolve &amp;quot;.&amp;quot; or &amp;quot;..&amp;quot;. And the shell performs other expansions, like file globbing, for which there&amp;#x27;s rarely any reason to implement in regular software. Supporting &amp;quot;~&amp;quot; expansion but not file globbing is inconsistent; if you&amp;#x27;re not the shell, don&amp;#x27;t implement shell-like features as it just creates confusion and unnecessary complexity.&lt;p&gt;Calling &amp;quot;..&amp;quot; a holdout from POSIX is misleading. The semantics exist for legitimate and even security-relevant reasons, albeit not necessarily reasons that an embedded smartphone OS may care about. What POSIX lacks is O_BENEATH (from Capsicum) or a similar flag for tagging a directory descriptor to prevent relative paths or otherwise ascending the tree. Capsicum extensions make POSIX perfectly capable of implementing strict capability semantics, and they do so by &lt;i&gt;extending&lt;/i&gt; semantics in a manner consistent with POSIX. POSIX isn&amp;#x27;t inherently broken in this regard, it&amp;#x27;s just perhaps too feature rich for some use cases and not feature rich enough for others.&lt;p&gt;There&amp;#x27;s no end of complaints about POSIX--either it&amp;#x27;s &lt;i&gt;too&lt;/i&gt; complex or &lt;i&gt;too&lt;/i&gt; simple. The fact is, no single specification will ever please anybody, so griping about how POSIX is broken is not only pointless but belies a failure to appreciate the underling issues. The alternative to POSIX is basically &lt;i&gt;nothing&lt;/i&gt;. Standardizing on Linux is, at best, a lateral move. Adding optional components to specifications has proven the worse of all worlds, and like most other standards POSIX has been slowly removing some optional components altogether while making others mandatory.</text></comment>
<story><title>Dot Dot Considered Harmful</title><url>https://fuchsia.googlesource.com/docs/+/HEAD/the-book/dotdot.md</url></story><parent_chain><item><author>delinka</author><text>&amp;gt;If a handle is provided to a directory, it should imply access to resources within that directory (and additionally, their subdirectories).&lt;p&gt;Maybe within Fuschia, but not in my UNIXy systems. All users on a system need r-x on &amp;#x2F;Users, but that doesn&amp;#x27;t give them r-x on every user&amp;#x27;s home directory located as a subdirectoy of &amp;#x2F;Users - a handle acquired by bob to &amp;#x2F;Users does not imply access to &amp;#x2F;Users&amp;#x2F;delinka.&lt;p&gt;Further, if your process is treating &amp;#x27;..&amp;#x27; as a subdirectory, you&amp;#x27;re doing it wrong. Paths must be normalized (e.g. ~ expanded, . and .. resolved) before requesting a handle via absolute path.&lt;p&gt;Lastly, this document reads as if knowing a full path grants access to that path and its subdirectories. If that&amp;#x27;s the case ... oy.</text></item></parent_chain><comment><author>ninkendo</author><text>The answer to that for a capability-based system would be to not grant a process access to &amp;#x2F;Users, but instead give it an opaque handle that grants access to &amp;#x2F;Users&amp;#x2F;delinka.  It&amp;#x27;s definitely not how unix systems work (where you need read access to all of the parents to access a child directory), but in a capability-based system it makes sense IMO.</text></comment>