linux-kernel - Re: Should unprivileged linkat(..., AT_EMPTY_PATH) work on O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87haevbkvw.fsf@linux.vnet.ibm.com>
Date:	Mon, 12 Aug 2013 09:50:19 +0530
From:	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	linux-kernel@...r.kernel.org,
	Linux FS Devel <linux-fsdevel@...r.kernel.org>,
	Al Viro <viro@...iv.linux.org.uk>
Subject: Re: Should unprivileged linkat(..., AT_EMPTY_PATH) work on O_TMPFILE files?

Andy Lutomirski <luto@...capital.net> writes:

> On Sun, Aug 11, 2013 at 9:45 AM, Aneesh Kumar K.V
> <aneesh.kumar@...ux.vnet.ibm.com> wrote:
>> Andy Lutomirski <luto@...capital.net> writes:
>>
>>> The change:
>>>
>>> commit f4e0c30c191f87851c4a53454abb55ee276f4a7e
>>> Author: Al Viro <viro@...iv.linux.org.uk>
>>> Date:   Tue Jun 11 08:34:36 2013 +0400
>>>
>>>     allow the temp files created by open() to be linked to
>>>
>>>     O_TMPFILE | O_CREAT => linkat() with AT_SYMLINK_FOLLOW and /proc/self/fd/<n>
>>>     as oldpath (i.e. flink()) will create a link
>>>     O_TMPFILE | O_CREAT | O_EXCL => ENOENT on attempt to link those guys
>>>
>>>     Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
>>>
>>> makes it possible to hardlink an O_TMPFILE file using procfs.  Should
>>> linkat(fd, "", newdirfd, newpath, AT_EMPTY_PATH) also work?
>>>
>>> AFAICS it currently requires CAP_DAC_READ_SEARCH, but I'm a bit
>>> confused as to why linkat(..., AT_EMPTY_PATH) should have a stricter
>>> check than linkat(AT_FDCWD, "/proc/self/fd/n", ...,
>>> AT_SYMLINK_FOLLOW),  (The relevant change is
>>> 11a7b371b64ef39fc5fb1b6f2218eef7c4d035e3.)
>>>
>>> FWIW, this program works on Linux 3.9, which makes me doubt that the
>>> security restriction on linkat is doing any good:
>>>
>>> #include <stdio.h>
>>> #include <err.h>
>>> #include <fcntl.h>
>>> #include <unistd.h>
>>>
>>> int main(int argc, char **argv)
>>> {
>>>   char buf[128];
>>>
>>>   if (argc != 3)
>>>     errx(1, "Usage: flink FD PATH");
>>>
>>>   sprintf(buf, "/proc/self/fd/%d", atoi(argv[1]));
>>>   if (linkat(AT_FDCWD, buf, AT_FDCWD, argv[2], AT_SYMLINK_FOLLOW) != 0)
>>>     err(1, "linkat");
>>>   return 0;
>>> }
>>>
>>>
>>> Removing the check from the AT_EMPTY_PATH case would simplify code
>>> that wants to write a file, fsync it, and then flink it in.
>>
>> I understand that this got merged upstream. But in case of the above
>> test we would walk the path pointed by /proc/self/fd/<x> right ?
>>
>> ie,
>>
>> 20 -> /home/no-access/k
>>
>> will the above test work ? Now if i pass the '20' to another application
>> I can affectively create a hardlink to that outside no-access and if k
>> happens to have 'r' for others, then everybody will be able to read
>> right ?. I understand that limitting the read access based on directory
>> permission is not a good idea. But aren't we expected to keep that ?
>
> The symlinks in /proc/self/fd are rather magical and don't actually
> walk the path.  Give it a try :)
>

How about fd passed from one application to another(say from a1 to
a2). a2 won't have read permission on /proc/a1/fd/ and also don't know
the value of file descriptor he should use right ? Will the /proc/self/fd
method work in such case ? IIUC with AT_EMPTY_PATH a2 can create the
link in the above case right ? So if /proc/self/fd doesn't work should
we allow that ?

-aneesh

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/