bugtraq - Re: Changes to the filesystem while find is running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200411231859.iANIxc0313292@milan.maths.usyd.edu.au>
Date: Wed, 24 Nov 2004 05:59:38 +1100 (EST)
From: psz@...hs.usyd.edu.au (Paul Szabo)
To: bugtraq@...ession.spiral-arm.org
Cc: srevilak@...akeasy.net, parimiv@...haw.com, martin.buchholz@....com,
	levon@...ementarian.org, bugtraq@...urityfocus.com, bug-findutils@....org
Subject: Re: Changes to the filesystem while find is running - comments?

James,

>> Hmm... It would not descend into just-now-changed automounts (and it may
>> not be able to get back out of them), but it should be able to traverse
>> reasonably long-lived mounts.
> 
> The problem is though that when you chdir() into an automount mount
> point, automount aill automatically mount it for you.  Hence if an
> automount filesystem wasn't already mounted, if you chdir() into it it
> immediately becomes a "just-now-changed" mount point.  That's the
> essensce of the problem I am trying to solve.

I think find should never cause an automount to "trigger" and cause it to
be mounted. It is OK to traverse if it was mounted to start with; is surely
not OK to traverse if it wasn't already mounted. Maybe your problem is
sidestepped by this principle?

[Right now cannot think of examples where find causing automounts to
trigger would be an obvious security or performance issue.]

To prevent find from causing an automount to trigger, maybe you could
somehow detect the presence of the mount point, check its status, and
(after a warning) not descend if it wasn't mounted. [I use the Debian
autofs package; this uses a normally empty directory, which is populated
with mounted directories when in use. Are we talking about the short time
between the mkdir of the mountpoint and the mount?]

Cheers,

Paul Szabo - psz@...hs.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia