bugtraq - Re: /proc filesystem allows bypassing directory permissions on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091103093211.GE24791@boogie.lpds.sztaki.hu>
Date: Tue, 3 Nov 2009 10:32:11 +0100
From: Gabor Gombas <gombasg@...aki.hu>
To: mrex@....com
Cc: pavel@....cz, jim@...n.com, marco@....nl, dan@...htwave.net.ru,
	bugtraq@...urityfocus.com
Subject: Re: /proc filesystem allows bypassing directory permissions on

On Tue, Nov 03, 2009 at 12:33:28AM +0100, Martin Rex wrote:

> > "mount --bind" behaves like a hard link and it does not increment the link
> > count.
> 
> that seems to work similar to a hardlink on a directory (and also requires
> root privileges).  It doesn't work for the same directory level, because
> of this (the directory permissions of the mounted directories and
> directories below it remain effective -- the permissions of directories
> above disappear, however!

I was speaking about single file bind-mounts, not directories.

# touch /tmp/a
# mount --bind /etc/passwd /tmp/a
# ls -l /etc/passwd
-rw-r--r-- 1 root root 1990 2009-08-24 16:22 /etc/passwd
# cat /tmp/a
root:x:0:0:root:/root:/bin/bash
[...]

Two references to the same inode, yet the link count is 1 and /proc is
nowhere in the picture.

Gabor

-- 
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------