linux-kernel - Re: regression: 4.13 cannot follow symlinks on some ext3 fs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171124165102.GS2482@two.firstfloor.org>
Date:   Fri, 24 Nov 2017 08:51:02 -0800
From:   Andi Kleen <andi@...stfloor.org>
To:     Andreas Dilger <adilger@...ger.ca>
Cc:     Andi Kleen <andi@...stfloor.org>, Theodore Ts'o <tytso@....edu>,
        Tahsin Erdogan <tahsin@...gle.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        linux-ext4 <linux-ext4@...r.kernel.org>
Subject: Re: regression: 4.13 cannot follow symlinks on some ext3 fs

> We checked old kernels, and old e2fsprogs, and didn't see any cases
> where fast (<= 60 chars) symlinks were created using external blocks.
> It seems that _something_ did create them, and it would be good to
> figure that out so we can determine if it is a widespread problem

I assume it was the original kernel. 

> 
> I think e2fsck can fix this quite easily, and there really isn't
> an easy way to revert to the old method if the large xattr feature
> is enabled.  If you are willing to run a new kernel, you should also
> be willing to run a new e2fsck.

It's obviously not enabled on ext3.

> 
> We could probably add a fallback to the old mechanism (and print
> a one-time warning to upgrade to a newer e2fsck) if an external fast
> symlink is found and the large xattr  feature is not enabled, which
> would give more time to fix this (hopefully rare in the wild) case.

If the old kernel created it, then likely all the
/lib{,64}/ld-linux.so.2 symlinks have that, which breaks all ELF 
executables. I suspect in these old file systems it's not particularly rare.

So I don't think you can just break them all.

I think it's ok to only handle it when the large xattrs are disabled.

Requiring new e2fsck on old systems is a bad idea.

-Andi