From: Kees Cook <kees.cook@canonical.com>
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Yama: verify inode is symlink to avoid bind mounts
Date: Tue, 13 Jul 2010 23:53:37 -0700 [thread overview]
Message-ID: <20100714065337.GY6104@outflux.net> (raw)
In-Reply-To: <20100714023048.GB17686@hallyn.com>
On Tue, Jul 13, 2010 at 09:30:48PM -0500, Serge E. Hallyn wrote:
> Quoting Kees Cook (kees.cook@canonical.com):
> > The inode_follow_link LSM hook is called in bind mount situations as
> > well as for symlink situations, so we must explicitly check for the
> > inode being a symlink to not reject bind mounts in 1777 directories,
>
> Are you sure about that??
>
> If that's true, you might also expand the comment in
> include/linux/security.h.
>
> > which seems to be a common NFSv4 configuration.
Well, the issue is how the NFSv4 client deals with it. It seems to treat
the mounts from the NFSv4 root as a symlink when the server is using bind
mounts. It's kind of weird:
https://launchpad.net/bugs/604407
--
Kees Cook
Ubuntu Security Team
next prev parent reply other threads:[~2010-07-14 6:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-13 22:30 [PATCH] Yama: verify inode is symlink to avoid bind mounts Kees Cook
2010-07-14 2:30 ` Serge E. Hallyn
2010-07-14 6:53 ` Kees Cook [this message]
2010-07-14 6:12 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100714065337.GY6104@outflux.net \
--to=kees.cook@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.