[lkml]   [2009]   [Dec]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 0/3] vfs: plug some holes involving LAST_BIND symlinks and file bind mounts (try #5)
    On Mon, Nov 23, 2009 at 06:15:45PM -0500, Jeff Layton wrote:

    > The big question with all of this is: Should a task have the ability
    > to follow a /proc/pid symlink to a path that it wouldn't ordinarily be
    > able to resolve with a path lookup. The concensus that I got from the
    > bugtraq discussion was that it should not, and this patch is an attempt
    > to prevent that.
    > I take it from you and Eric's comments that you disagree? If so, what's
    > your rationale for allowing a task to resolve this symlink when it
    > wouldn't ordinarily be able to do so if it were a "normal" symlink?

    WTF not? It's convenient and doesn't lose any real security. If your
    code relies on inaccessibility of <path> since some component of that
    path is inaccessible, you are *already* fscked. Consider e.g. fchdir()
    and its implications - if you have an opened descriptor for parent,
    having no exec permissions on grandparent won't stop you at all. Already.
    On all Unices, regardless of openat(), etc.

    And that's aside of being able to see the same object at some other pathname.
    Which is also possible in a lot of ways. IOW, any code relying on that class
    of assumptions is very likely to be widely b0rken, even if you leave aside the
    long-standing behaviour of Linux.

    I might buy the argument about restricting reopening with wider permissions,
    a) we still are looking at possible userland breakage of the worst
    kind - random scripts passing /dev/fd/42 as command line arguments to
    random programs. Once in a while. With error checking being... not quite
    b) it's not just open - we have at least chmod/chown/truncate to
    deal with.

    Prohibiting *all* access is a complete non-starter - things like
    cmp foo /dev/stdin || ....
    would bloody better work and nobody cares whether you have redirect
    from something out of your reach at the moment.

     \ /
      Last update: 2009-12-16 14:05    [W:0.023 / U:15.108 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site