Hector Martin

I feel like I have done exactly that. Or are you excluding world r/w files that can’t be gotten to? I.e. in a directory that is 0700? What about a hard link created in a different directory that is accessible? @ssrjazz do you have input here?

Yes creating a hard link to an inode may be tricky, but it’s not impossible.

Uh, no, that's impossible (without using root-only debug facilities). Doing so would be a massive security hole.

I’m fairly certain that it is possible to create a hard link to an inode even if you can’t access the directory that the other file linked to the inode is in. @ssrjazz what do you think? o+w on the inode in question and +w on the directory I’m creating the new link in.

Write the code, file the CVE, and get the sweet PoC karma then ;-)

Nope. I don’t know how to do it myself. Besides I believe that I’ve read about it multiple times in the past. So nothing new.

Citation needed.

Quick search undeleting open files returns debugfs to create new links to an inode. You just need the inode number and a place to create the link.