linux-kernel - Re: procfs readlink after unshare() in a chroot() reports the full path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YyDPdr7v/ltQI+wc@localhost.localdomain>
Date:   Tue, 13 Sep 2022 21:44:06 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     David Laight <David.Laight@...lab.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: procfs readlink after unshare() in a chroot() reports the full
 path

On Fri, Sep 09, 2022 at 10:06:32AM +0000, David Laight wrote:
> The readlink calls in procfs (eg for /proc/self/fd/0) returns
> the full pathname if unshare() is called inside a chroot.
> 
> The program below reproduces this when run with stdin
> redirected to a file in the current directory.
> 
> This sequence is used by 'ip netns exec' so isn't actually
> that unusual.
> 
> 	David
> 
> #define _GNU_SOURCE
> #include <unistd.h>
> #include <stdio.h>
> #include <fcntl.h>
> #include <sched.h>
> 
> static void print_link(const char *where, int fd)
> {
>         char buf[256];
> 
>         printf("%s: %.*s\n", where, (int)readlinkat(fd, "", buf, sizeof buf), buf);
> }
> 
> int main(int argc, char **argv)
> {
>         int link_fd = open("/proc/self/fd/0", O_PATH | O_NOFOLLOW);
> 
>         print_link("initial", link_fd);
>         if (chroot("."))
>                 return 1;
>         print_link("after chroot", link_fd);
>         if (unshare(CLONE_NEWNS))
>                 return 2;
>         print_link("after unshare", link_fd);
>         return 0;
> }

I tested mainline and 5.19.8, both are OK:

open("/proc/self/fd/0", O_RDONLY|O_NOFOLLOW|O_PATH) = 3
readlinkat(3, "", "/dev/pts/0", 256)    = 10
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd94753e000
write(1, "initial: /dev/pts/0\n", 20initial: /dev/pts/0
)   = 20
chroot(".")                             = 0
readlinkat(3, "", "/dev/pts/0", 256)    = 10
write(1, "after chroot: /dev/pts/0\n", 25after chroot: /dev/pts/0
) = 25
unshare(CLONE_NEWNS)                    = 0
readlinkat(3, "", "/dev/pts/0", 256)    = 10
write(1, "after unshare: /dev/pts/0\n", 26after unshare: /dev/pts/0
) = 26