linux-kernel - Re: BUG: Securityfs and bind mounts (2.6.34)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <201007081555.01242.tvrtko.ursulin@sophos.com>
Date:	Thu, 8 Jul 2010 15:55:01 +0100
From:	Tvrtko Ursulin <tvrtko.ursulin@...hos.com>
To:	Greg KH <greg@...ah.com>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Al Viro <viro@...iv.linux.org.uk>
Subject: Re: BUG: Securityfs and bind mounts (2.6.34)

On Thursday 08 Jul 2010 15:43:17 Greg KH wrote:
> On Thu, Jul 08, 2010 at 11:12:41AM +0100, Tvrtko Ursulin wrote:
> > Hi guys,
> >
> > If I overlay a file in securityfs using mount --bind with a file from
> > a regular filesystem, should I be allowed to rmmod the module which
> > registered the overlaid securityfs file?
>
> Why would you want to overlay securityfs in the first place?

For testing, more precisely faking some data exposed in securityfs module in
order to provoke userspace reaction. It was convenient to leave the majority
of real data and just overlay one file.

> And you might be able to rmmod the module, but I didn't think that
> security modules were able to be unloaded anymore.

Perhaps it is not a security module in the way you think about it, just a
module which happens to register some directories and files under securityfs.

> > I was able to do that, then I
> > unmounted the bind mount, and then when attempting to unmount
> > securityfs hit a BUG at
> > fs/dcache.c:676 (see below). It would have made more sense to first
> > umount the overlay file and then remove the module which registered
> > with securityfs, nevertheless should kernel crash in this case?
>
> Probably not, but then again, you did something that you shouldn't have,
> so perhaps it is telling you not to do such a thing in the future :)

:) Well I do not know, but, it kind of smelled like a bug in the vfs/mount
handling/securityfs area so I thought to let experts know. I _think_ I did
nothing that much wrong. Just used the exposed API (securityfs_remove) and
some bind mount shuffling from userspace.

Tvrtko

Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom.
Company Reg No 2096520. VAT Reg No GB 348 3873 20.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/