Messages in this thread Patch in this message | | | Date | Wed, 11 Nov 1998 09:36:37 -0500 (EST) | From | Alexander Viro <> | Subject | [PATCH] bugs around truncate. |
| |
[Cc'd to maintainers]
a) open_namei() with O_CREAT, O_TRUNC but without O_NOFOLLOW is called in fs/binfmt_aout::119, arch/mips/kernel/irixelf.c::1200, arch/sparc64/kernel/binfmt_aout32::109. Security hole (see binfmt_elf)
b) open_namei with O_TRUNC but without FMODE_WRITE may do _really_ bad things with directories. All paths take care of that, but probably it would be better to take care in open_namei(). Comments?
c) All paths leading to truncate method of inode don't let us through for directories [Good Thing (tm)]. There are directory inodes with truncate being defined (and damn destructive), namely: ext2, minix, sysv, ufs. Al
Patch for (a) and (c) follows:
--- fs/minix/dir.c.old Sun Oct 4 18:32:38 1998 +++ fs/minix/dir.c Wed Nov 11 08:22:19 1998 @@ -55,7 +55,7 @@ NULL, /* readpage */ NULL, /* writepage */ NULL, /* bmap */ - minix_truncate, /* truncate */ + NULL, /* truncate */ NULL /* permission */ }; --- fs/ext2/dir.c.old Sun Oct 4 18:32:37 1998 +++ fs/ext2/dir.c Wed Nov 11 08:23:43 1998 @@ -70,7 +70,7 @@ NULL, /* readpage */ NULL, /* writepage */ NULL, /* bmap */ - ext2_truncate, /* truncate */ + NULL, /* truncate */ ext2_permission, /* permission */ NULL /* smap */ }; --- fs/sysv/dir.c.old Sun Oct 4 18:32:39 1998 +++ fs/sysv/dir.c Wed Nov 11 08:24:48 1998 @@ -62,7 +62,7 @@ NULL, /* readpage */ NULL, /* writepage */ NULL, /* bmap */ - sysv_truncate, /* truncate */ + NULL, /* truncate */ NULL /* permission */ }; --- fs/ufs/dir.c.old Sat Oct 24 22:36:29 1998 +++ fs/ufs/dir.c Wed Nov 11 08:25:37 1998 @@ -221,7 +221,7 @@ NULL, /* readpage */ NULL, /* writepage */ ufs_bmap, /* bmap */ - ufs_truncate, /* truncate */ + NULL, /* truncate */ ufs_permission, /* permission */ NULL, /* smap */ }; --- fs/binfmt_aout.c.old Sun Oct 4 18:32:59 1998 +++ fs/binfmt_aout.c Wed Nov 11 08:29:59 1998 @@ -116,7 +116,7 @@ #else corefile[4] = '\0'; #endif - dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC, 0600); + dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600); if (IS_ERR(dentry)) { dentry = NULL; goto end_coredump; --- arch/mips/kernel/irixelf.c.old Sat Oct 24 22:36:10 1998 +++ arch/mips/kernel/irixelf.c Wed Nov 11 08:31:43 1998 @@ -1197,7 +1197,7 @@ #else corefile[4] = '\0'; #endif - dentry = open_namei(corefile, O_CREAT | 2 | O_TRUNC, 0600); + dentry = open_namei(corefile, O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600); if (IS_ERR(dentry)) { inode = NULL; goto end_coredump; --- arch/sparc64/kernel/binfmt_aout32.c.old Sun Oct 4 19:09:44 1998 +++ arch/sparc64/kernel/binfmt_aout32.c Wed Nov 11 08:33:51 1998 @@ -106,7 +106,7 @@ #else corefile[4] = '\0'; #endif - dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC, 0600); + dentry = open_namei(corefile,O_CREAT | 2 | O_TRUNC | O_NOFOLLOW, 0600); if (IS_ERR(dentry)) { dentry = NULL; goto end_coredump;
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |