Index | Thread | Search

From:
Ingo Schwarze <schwarze@usta.de>
Subject:
Re: Skip fuse FS by /usr/libexec/security
To:
"Kirill A. Korinsky" <kirill@korins.ky>
Cc:
tech@openbsd.org, Sylvestre Gallon <ccna.syl@gmail.com>, Helg Bredow <helg@openbsd.org>
Date:
Wed, 15 May 2024 19:47:55 +0200

Download raw body.

Thread
Hello,

Ingo Schwarze wrote on Wed, May 15, 2024 at 07:06:10PM +0200:
> Kirill A. Korinsky wrote on Wed, May 01, 2024 at 06:00:24PM +0200:
>> "Kirill A. Korinsky" <kirill@korins.ky> wrote:

> Your code says:
>   $opt =~ /local/ && $type == /fuse/

Sorry for replying to myself, but i really have to grind the Rust
off my Perl.  I gave you the benefit of the doubt here and unconciously
assumed you meant

  $type eq 'fuse'

here rather than

  $type == /fuse/

By default, "/fuse/" matches against $_ which is something like

  /dev/sd0a on / type ffs (local)
  /dev/foo on /path type fuse (local)
  
at this point.  The return value of m// in scalar context is 1 if the
regular expression matches and an empty string otherwise.
Coercing a non-numeric string like $type to a number yields 0,
so if $_ contains "fuse", we have 0 == 1, which is false.
If, on the other hand, $_ does not contain "fuse", we have 0 == ''
which happens to be true.

So i see now how the patch might have accidentally survived some
testing, but we clearly must not rely on all the above.
It's horrible obfuscation at best, and i'm far from convinced
it is correct in all cases.

Yours,
  Ingo