The next version of the Linux kernel, 7.2, will include the OPENAT2_REGULAR flag for the openat2 system call. This feature allows programs to ensure they only open regular files, preventing them from being redirected to special devices like /dev/null or FIFOs, which can cause unexpected blocking behavior and security vulnerabilities.
How OPENAT2_REGULAR works in the kernel 🛡️
The OPENAT2_REGULAR flag acts as a filter in the openat2 call. When activated, the kernel verifies that the target file is a regular file (S_IFREG) before allowing the open. If the file is a block device, a FIFO, or a socket, the operation fails with the error EISDIR or EPERM. This check occurs after resolving symbolic links, blocking attacks that use links to point to special devices. The implementation was requested by the UAPI group to protect applications that process user files.
Goodbye to scares with /dev/null and mischievous FIFOs 😅
Until now, a trusting program could open a file and find it was a FIFO that left it waiting for data forever, or worse, a /dev/null that swallowed all its output without a word. With OPENAT2_REGULAR, those scares are over: if the file is not regular, the kernel says no and the developer saves hours of debugging. It's like putting a filter on the disk input so only real files get through, not carnival disguises.