linux-kernel - Re: [PATCH 00/17] clean up readlinks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160927031019.GF19539@ZenIV.linux.org.uk>
Date:   Tue, 27 Sep 2016 04:10:19 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Miklos Szeredi <mszeredi@...hat.com>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        David Howells <dhowells@...hat.com>,
        Tyler Hicks <tyhicks@...onical.com>
Subject: Re: [PATCH 00/17] clean up readlinks

On Mon, Sep 12, 2016 at 09:29:02PM +0200, Miklos Szeredi wrote:
> The first patch is actually a bug fix, but I put it into this bunch for
> simplicity...
> 
> The rest are really cleanups as well as minor bugfixes that are byproducts
> of the cleanups.
> 
> This series builds on the fact that i_op.readlink is already set to
> generic_readlink() in 43/50 of the cases.  And of those 7 only 4 are doing
> something special.  So more than 90% of readlinks are/could actually just
> call back into get_link.
> 
> The interesting cases are:
> 
>  - AFS, which has readlink but not get_link
>  - proc, that allow jumping while following symlinks
> 
> The first is handled by setting IOP_NOFOLLOW on the inode by the fs.
> 
> The second one is handled by introducing is_following_link() which returns
> a bool depending on whether current->nameidata is NULL or not.  If it
> returns false ->get_link() should behave as ->readlink() did.  Otherwise it
> should behave as id did previously.
> 
> Builds and boots.  Can even read symlinks.

	I have no problem with "let's get rid of generic_readlink" - not that
it bought us much, but sure, if you want to have decision made based upon
the combination of flags, let's do it.  Just make NULL ->readlink + non-NULL
->get_link() mean generic_readlink(), and we are done.  Especially if you
do the usual "set the flag on inode the first time we need to check".
I also have no problem with overlayfs and ecryptfs assuming that we only deal
with normal symlinks.

	Overloading ->get_link() for procfs-style ones is just plain wrong,
though.  Your current->nameidata != NULL thing is bloody brittle - what
happens if some code triggers those readlinks when called by something
during pathname resolution?  Sure, right now existing callers won't.
But it doesn't take much to grow such a place _and_ have the implications
go unnoticed for quite a while.