linux-kernel - [WTF] ... is going on with current->fs->{root,mnt} accesses in pohmelfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100210100428.GL30031@ZenIV.linux.org.uk>
Date:	Wed, 10 Feb 2010 10:04:28 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	zbr@...emap.net
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [WTF] ... is going on with current->fs->{root,mnt} accesses in
 pohmelfs

a) pohmelfs_construct_path_string() will do interesting things if you
call it while chrooted into jail and pohmelfs mounted deeper in that
jail.  Try it.

b) just why do we care about root of chroot jail in pohmelfs_path_length()?
Not to mention anything else, current->fs->root/mnt may be changed under
you if you share current->fs with another thread, but even aside of that,
why does filesystem care about chroot of caller at all?

What's going on there?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/