linux-kernel - Re: [PATCH 00/17] clean up readlinks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Sep 2016 11:38:33 +0200
From:   Miklos Szeredi <mszeredi@...hat.com>
To:     Al Viro <viro@...iv.linux.org.uk>
Cc:     linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>,
        David Howells <dhowells@...hat.com>,
        Tyler Hicks <tyhicks@...onical.com>
Subject: Re: [PATCH 00/17] clean up readlinks

On Tue, Sep 27, 2016 at 5:10 AM, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Mon, Sep 12, 2016 at 09:29:02PM +0200, Miklos Szeredi wrote:
>> The first patch is actually a bug fix, but I put it into this bunch for
>> simplicity...
>>
>> The rest are really cleanups as well as minor bugfixes that are byproducts
>> of the cleanups.
>>
>> This series builds on the fact that i_op.readlink is already set to
>> generic_readlink() in 43/50 of the cases.  And of those 7 only 4 are doing
>> something special.  So more than 90% of readlinks are/could actually just
>> call back into get_link.
>>
>> The interesting cases are:
>>
>>  - AFS, which has readlink but not get_link
>>  - proc, that allow jumping while following symlinks
>>
>> The first is handled by setting IOP_NOFOLLOW on the inode by the fs.
>>
>> The second one is handled by introducing is_following_link() which returns
>> a bool depending on whether current->nameidata is NULL or not.  If it
>> returns false ->get_link() should behave as ->readlink() did.  Otherwise it
>> should behave as id did previously.
>>
>> Builds and boots.  Can even read symlinks.
>
>         I have no problem with "let's get rid of generic_readlink" - not that
> it bought us much, but sure, if you want to have decision made based upon
> the combination of flags, let's do it.  Just make NULL ->readlink + non-NULL
> ->get_link() mean generic_readlink(), and we are done.

Indeed.  Except it really should be the other way round:

- .get_link always returning the symlink body
- only proc setting .jump_link to do its thing
- RIP .readlink

But that's an extra branch in the symlink following.  I was worried
about that and hence gone for the unification of the two.

>
>         Overloading ->get_link() for procfs-style ones is just plain wrong,
> though.  Your current->nameidata != NULL thing is bloody brittle - what
> happens if some code triggers those readlinks when called by something
> during pathname resolution?  Sure, right now existing callers won't.
> But it doesn't take much to grow such a place _and_ have the implications
> go unnoticed for quite a while.

Yeah.  We can do your above suggestion, it's certainly less brittle.
But I think it's rather confusing, having ->get_link normally do
readlink, except for proc, where readlink is done by ->readlink.

Thanks,
Miklos