On Oct 19, 2005, at 4:30 PM, der Mouse wrote:

> Yes.  But note that for calls that involve a path walk, I was
> recommending using the path which is already at hand.  Something
> fh*()-like was only for calls which don't involve paths, and for  
> those,
> you must already have access to the vnode anyway, so performing checks
> based on a path walk is inappropriate.  After all, if you open a file
> and then, while it's open, protect the path, it doesn't prevent you
> from accessing the file as long as you keep it open.

Perhaps you're mis-understanding how fh*() work.  fhopen() allows you  
to open a file (using a file handle) that you DO NOT currently have  
open, and bypasses the full path permission checking along the way.   
For this reason, its use is restricted to the superuser.

-- thorpej