kern/117987: read(2) on directories might leak filenames of deleted files

[Pierre Riteau]

>Number:         117987
>Category:       kern
>Synopsis:       read(2) on directories might leak filenames of deleted files
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 11 20:20:00 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     Pierre Riteau
>Release:        FreeBSD 7.0-BETA2
>Organization:
>Environment:
FreeBSD freebsd.localdomain 7.0-BETA2 FreeBSD 7.0-BETA2 #0: Fri Nov  2 16:47:33 UTC 2007     root at logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
On FreeBSD, any user can open(2) and read(2) a directory when he has read rights to it. read(2)ing a directory dumps the content of the inode of that directory, which might leak filename of deleted files.
Those filenames may be secret.
>How-To-Repeat:
$ cd /home/pierre
$ ls
.               .history        .login_conf     .profile
.              .lesshst        .mail_aliases   .rhosts
.cshrc          .login          .mailrc         .shrc
$ chmod 700 . # no one should list the content of this directory now
$ touch secretfilename # no one should see this filename
$ rm secretfilename
$ chmod 755 . # ok, I can make it public, secretfilename is gone

Another user can now do :
$ cat -v /home/pierre
Ym
^@^L^@^D^A.^@^@^@Xm
^@^L^@^D^B..^@^@Zm
^@^P^@^H^F.cshrc^@M-L[m
^@^P^@^H^F.login^@M-L\m
^@^T^@^H^K.login_conf^@]m
^@^P^@^H^G.mailrc^@^m
^@^T^@^H^H.profile^@M-+M-^WM-L_m
^@^P^@^H^E.shrc^@M-^WM-L`m
^@^X^@^H^M.mail_aliases^@OM-Bam
^@^P^@^H^G.rhosts^@bm
^@^T^@^H^H.history^@M-;^NM-Mcm
^@D^A^H^H.lesshst^@^K^MM-Mdm
^@0^A^H^Nsecretfilename^@M-B^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@

and he sees the secretfilename.
>Fix:
On OpenBSD read(2)ing a directory always returns 0 (end-of-file) (on a FFS1 filesystem).

>Release-Note:
>Audit-Trail:
>Unformatted: