Messages in this thread | | | From | Tvrtko Ursulin <> | Subject | Re: BUG: Securityfs and bind mounts (2.6.34) | Date | Wed, 14 Jul 2010 17:19:46 +0100 |
| |
On Thursday 08 Jul 2010 16:46:48 Greg KH wrote: > On Thu, Jul 08, 2010 at 04:32:42PM +0100, Tvrtko Ursulin wrote: > > On Thursday 08 Jul 2010 16:20:59 Greg KH wrote: > > > > :) Well I do not know, but, it kind of smelled like a bug in the > > > > : vfs/mount > > > > > > > > handling/securityfs area so I thought to let experts know. I _think_ > > > > I did nothing that much wrong. Just used the exposed API > > > > (securityfs_remove) and some bind mount shuffling from userspace. > > > > > > securitfs just uses libfs underneath it, and really doesn't have any > > > bindings for module ownerships, so I wouldn't recommend doing what you > > > just did. > > > > Just do double check what you are saying, securityfs is not safe for use > > from modules? If so I would then recommend removing the exports otherwise > > it is an invitation to shoot yourself into the foot. > > Hm, did you properly set the module owner of the file_operations that > you passed to securityfs? That should protect if you have an open file, > but I doubt anyone thought you would do crazy things like bind mounts on > top of a ramfs and then think it was safe to unload a lower module :)
Hi again,
Here is the reproducer. Build the attached test module and put test.ko in the cwd. Then run:
umount /sys/kernel/security mount none -t securityfs /sys/kernel/security/ insmod test.ko mount file --bind /sys/kernel/security/test/file rmmod test insmod test.ko umount /sys/kernel/security/test/file umount /sys/kernel/security # <-------- BANG:
It is a bit different than what I initially said. It looks like reference counting on a dentry gets messed up once securityfs_create_dir() in second insmod of test.ko fails with -EEXIST.
HTH,
Tvrtko
Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom. Company Reg No 2096520. VAT Reg No GB 348 3873 20. #include <linux/kernel.h> #include <linux/module.h> #include <linux/fs.h> #include <linux/security.h>
static struct dentry *root; static struct dentry *file;
static int test_open(struct inode *inode, struct file *file) { return -1; }
static struct file_operations test_fops = { .owner = THIS_MODULE, .open = test_open, };
static int __init test_init(void) { root = securityfs_create_dir("test", NULL); if (IS_ERR(root)) { printk("error creating root %d\n", PTR_ERR(root)); return PTR_ERR(root); }
file = securityfs_create_file("file", S_IRUSR, root, NULL, &test_fops); if (IS_ERR(file)) { printk("error creating file %d\n", PTR_ERR(file)); securityfs_remove(root); return PTR_ERR(file); }
return 0; }
static void __exit test_exit(void) { securityfs_remove(file); securityfs_remove(root); }
MODULE_LICENSE("GPL");
module_init(test_init); module_exit(test_exit);
| |