lkml.org 
[lkml]   [1998]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] bugs around truncate.
[Cc'd to maintainers]

a) open_namei() with O_CREAT, O_TRUNC but without O_NOFOLLOW is called
in fs/binfmt_aout::119, arch/mips/kernel/irixelf.c::1200,
arch/sparc64/kernel/binfmt_aout32::109. Security hole (see binfmt_elf)

b) open_namei with O_TRUNC but without FMODE_WRITE may do _really_ bad
things with directories. All paths take care of that, but probably it
would be better to take care in open_namei(). Comments?

c) All paths leading to truncate method of inode don't let us through
for directories [Good Thing (tm)]. There are directory inodes with
truncate being defined (and damn destructive), namely: ext2, minix,
sysv, ufs.
Al

Patch for (a) and (c) follows:

--- fs/minix/dir.c.old Sun Oct 4 18:32:38 1998
+++ fs/minix/dir.c Wed Nov 11 08:22:19 1998
@@ -55,7 +55,7 @@
NULL, /* readpage */
NULL, /* writepage */
NULL, /* bmap */
- minix_truncate, /* truncate */
+ NULL, /* truncate */
NULL /* permission */
};

--- fs/ext2/dir.c.old Sun Oct 4 18:32:37 1998
+++ fs/ext2/dir.c Wed Nov 11 08:23:43 1998
@@ -70,7 +70,7 @@
NULL, /* readpage */
NULL, /* writepage */
NULL, /* bmap */
- ext2_truncate, /* truncate */
+ NULL, /* truncate */
ext2_permission, /* permission */
NULL /* smap */
};
--- fs/sysv/dir.c.old Sun Oct 4 18:32:39 1998
+++ fs/sysv/dir.c Wed Nov 11 08:24:48 1998
@@ -62,7 +62,7 @@
NULL, /* readpage */
NULL, /* writepage */
NULL, /* bmap */
- sysv_truncate, /* truncate */
+ NULL, /* truncate */
NULL /* permission */
};

--- fs/ufs/dir.c.old Sat Oct 24 22:36:29 1998
+++ fs/ufs/dir.c Wed Nov 11 08:25:37 1998
@@ -221,7 +221,7 @@
NULL, /* readpage */
NULL, /* writepage */
ufs_bmap, /* bmap */
- ufs_truncate, /* truncate */
+ NULL, /* truncate */
ufs_permission, /* permission */
NULL, /* smap */
};
--- fs/binfmt_aout.c.old Sun Oct 4 18:32:59 1998
+++ fs/binfmt_aout.c Wed Nov 11 08:29:59 1998
@@ -116,7 +116,7 @@
#else
corefile[4] = '\0';
#endif
- dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC, 0600);
+ dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
if (IS_ERR(dentry)) {
dentry = NULL;
goto end_coredump;
--- arch/mips/kernel/irixelf.c.old Sat Oct 24 22:36:10 1998
+++ arch/mips/kernel/irixelf.c Wed Nov 11 08:31:43 1998
@@ -1197,7 +1197,7 @@
#else
corefile[4] = '\0';
#endif
- dentry = open_namei(corefile, O_CREAT | 2 | O_TRUNC, 0600);
+ dentry = open_namei(corefile, O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
if (IS_ERR(dentry)) {
inode = NULL;
goto end_coredump;
--- arch/sparc64/kernel/binfmt_aout32.c.old Sun Oct 4 19:09:44 1998
+++ arch/sparc64/kernel/binfmt_aout32.c Wed Nov 11 08:33:51 1998
@@ -106,7 +106,7 @@
#else
corefile[4] = '\0';
#endif
- dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC, 0600);
+ dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600);
if (IS_ERR(dentry)) {
dentry = NULL;
goto end_coredump;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:45    [W:1.182 / U:0.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site