linux-kernel - Re: procfs: open("/proc/self/fd/...") allows bypassing O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Uc-5mYLV3EgTlSFyEEzmpLvNdXKVJSL9pOSCiNylGIONHoljlV9kKizN2bz6lHsTDPDR_4ugSxLYNCO7xjdSeF3daahq8_kvxWhpIvXcuHA=@emersion.fr>
Date:   Thu, 12 May 2022 12:38:50 +0000
From:   Simon Ser <contact@...rsion.fr>
To:     Amir Goldstein <amir73il@...il.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
Subject: Re: procfs: open("/proc/self/fd/...") allows bypassing O_RDONLY

On Thursday, May 12th, 2022 at 14:30, Amir Goldstein <amir73il@...il.com> wrote:

> Clients can also readlink("/proc/self/fd/<fd>") to get the path of the file
> and open it from its path (if path is accessible in their mount namespace).

What the compositor does is:

- shm_open with O_RDWR
- Write the kyeboard keymap
- shm_open again the same file with O_RDONLY
- shm_unlink
- Send the O_RDONLY FD to clients

Thus, the file doesn't exist anymore when clients get the FD.

> Would the clients typically have write permission to those files?
> Do they need to?

Compositors need to disallow clients from writing to the shared files.
If a client gets write access to the shared file, they can corrupt the
keyboard keymap (and other data) used by all other clients.

> > intended behavior, what would be a good way to share a FD to another
> > process without allowing it to write to the underlying file?
>
> If wayland can use a read-only bind mount to the location of the files that it
> needs to share, then re-open will get EROFS.

Wayland just uses FD passing via Unix sockets to share memory. It
doesn't (and can't) assume anything regarding the filesystem layout,
because the clients might be running in a separate namespace with a
completely different layout (e.g. Flatpak).