From: Ross Zwisler <zwisler@google.com>
To: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-kernel@vger.kernel.org,
Mattias Nissler <mnissler@chromium.org>,
Aleksa Sarai <cyphar@cyphar.com>,
Andrew Morton <akpm@linux-foundation.org>,
Benjamin Gordon <bmgordon@google.com>,
David Howells <dhowells@redhat.com>,
Dmitry Torokhov <dtor@google.com>,
Jesse Barnes <jsbarnes@google.com>,
linux-fsdevel@vger.kernel.org, linux-kselftest@vger.kernel.org,
Matthew Wilcox <willy@infradead.org>,
Micah Morton <mortonm@google.com>,
Raul Rangel <rrangel@google.com>, Shuah Khan <shuah@kernel.org>
Subject: Re: [PATCH v8 1/2] Add a "nosymfollow" mount option.
Date: Wed, 26 Aug 2020 14:48:19 -0600 [thread overview]
Message-ID: <20200826204819.GA4414@google.com> (raw)
In-Reply-To: <20200819164317.637421-1-zwisler@google.com>
O Wed, Aug 19, 2020 at 10:43:16AM -0600, Ross Zwisler wrote:
> From: Mattias Nissler <mnissler@chromium.org>
>
> For mounts that have the new "nosymfollow" option, don't follow symlinks
> when resolving paths. The new option is similar in spirit to the
> existing "nodev", "noexec", and "nosuid" options, as well as to the
> LOOKUP_NO_SYMLINKS resolve flag in the openat2(2) syscall. Various BSD
> variants have been supporting the "nosymfollow" mount option for a long
> time with equivalent implementations.
>
> Note that symlinks may still be created on file systems mounted with
> the "nosymfollow" option present. readlink() remains functional, so
> user space code that is aware of symlinks can still choose to follow
> them explicitly.
>
> Setting the "nosymfollow" mount option helps prevent privileged
> writers from modifying files unintentionally in case there is an
> unexpected link along the accessed path. The "nosymfollow" option is
> thus useful as a defensive measure for systems that need to deal with
> untrusted file systems in privileged contexts.
>
> More information on the history and motivation for this patch can be
> found here:
>
> https://sites.google.com/a/chromium.org/dev/chromium-os/chromiumos-design-docs/hardening-against-malicious-stateful-data#TOC-Restricting-symlink-traversal
>
> Signed-off-by: Mattias Nissler <mnissler@chromium.org>
> Signed-off-by: Ross Zwisler <zwisler@google.com>
> Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
> ---
> Changes since v7 [1]:
> * Rebased onto v5.9-rc1.
> * Added selftest in second patch.
> * Added Aleska's Reviewed-By tag. Thank you for the review!
>
> After this lands I will upstream changes to util-linux[2] and man-pages
> [3].
>
> [1]: https://lkml.org/lkml/2020/8/11/896
> [2]: https://github.com/rzwisler/util-linux/commit/7f8771acd85edb70d97921c026c55e1e724d4e15
> [3]: https://github.com/rzwisler/man-pages/commit/b8fe8079f64b5068940c0144586e580399a71668
> ---
Friendly ping on this.
Al, now that the changes to fs/namei.c have landed and we're past the merge
window for v5.9, what are your thoughts on this patch and the associated test?
next prev parent reply other threads:[~2020-08-26 20:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-19 16:43 [PATCH v8 1/2] Add a "nosymfollow" mount option Ross Zwisler
2020-08-19 16:43 ` [PATCH v8 2/2] selftests: mount: add nosymfollow tests Ross Zwisler
2020-08-26 20:48 ` Ross Zwisler [this message]
2020-08-27 1:59 ` [PATCH v8 1/2] Add a "nosymfollow" mount option Al Viro
2020-08-27 15:41 ` Aleksa Sarai
2020-08-27 16:48 ` Ross Zwisler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200826204819.GA4414@google.com \
--to=zwisler@google.com \
--cc=akpm@linux-foundation.org \
--cc=bmgordon@google.com \
--cc=cyphar@cyphar.com \
--cc=dhowells@redhat.com \
--cc=dtor@google.com \
--cc=jsbarnes@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=mnissler@chromium.org \
--cc=mortonm@google.com \
--cc=rrangel@google.com \
--cc=shuah@kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.