{"id":629,"date":"2012-10-01T12:59:39","date_gmt":"2012-10-01T20:59:39","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=629"},"modified":"2012-10-01T12:59:39","modified_gmt":"2012-10-01T20:59:39","slug":"link-restrictions-released-in-linux-3-6","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2012\/10\/01\/link-restrictions-released-in-linux-3-6\/","title":{"rendered":"Link restrictions released in Linux 3.6"},"content":{"rendered":"<p>It&#8217;s been a very long time coming, but <a href=\"http:\/\/git.kernel.org\/?p=linux\/kernel\/git\/torvalds\/linux.git;a=commitdiff;h=800179c9b8a1e796e441674776d11cd4c05d61d7\">symlink and hardlink restrictions<\/a> have finally landed in the mainline Linux kernel as of version 3.6. The protection is at least old enough to have a driver&#8217;s license in <a href=\"http:\/\/en.wikipedia.org\/wiki\/Driver%27s_license_in_the_United_States#Hardship_Licenses_for_Minors_aged_14_to_15_and_GDL_Laws_in_the_50_states_and_the_District_of_Columbia\">most US states<\/a>, with some of the first discussions I could find dating from <a href=\"http:\/\/marc.info\/?l=bugtraq&#038;m=87602167419830&#038;w=2\">Aug 1996<\/a>.<\/p>\n<p>While this protection is old (to ancient) news for anyone running Chrome OS, Ubuntu, grsecurity, or OpenWall, I&#8217;m extremely excited that is can now benefit everyone running Linux. All the way from cloud monstrosities to cell phones, an <a href=\"http:\/\/en.wikipedia.org\/wiki\/Symlink_race\">entire class of vulnerability<\/a> just goes away. Thanks to everyone that had a part in developing, testing, reviewing, and encouraging these changes over the years. It&#8217;s quite a relief to have it finally done. I hope I never have to include the year in my patch revision serial number again. :)<\/p>\n<p style='text-align:left'>&copy; 2012, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s been a very long time coming, but symlink and hardlink restrictions have finally landed in the mainline Linux kernel as of version 3.6. The protection is at least old enough to have a driver&#8217;s license in most US states, with some of the first discussions I could find dating from Aug 1996. While this [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,20,18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/629"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=629"}],"version-history":[{"count":1,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/629\/revisions"}],"predecessor-version":[{"id":630,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/629\/revisions\/630"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}