FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability

[Dag-Erling Smørgrav]

Eygene Ryabinkin <rea-fbsd at codelabs.ru> writes:
> May be the attached patch will fix the thing? 

I'm not entirely convinced.  Try the regression test I wrote
(head/tools/regression/vfs/trailing_slash.t)

> It adds an additional flag, but this was the only thing I was able to
> invent to avoid ABI breakage.

The flag is a good idea, but I think the correct place to handle this is
in namei(), around line 290 (don't be fooled by the comment on line 270;
the code inside the if statement is for the *non*-symlink case).

DES
-- 
Dag-Erling Smørgrav - des at des.no