From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: [PATCH v9 01/10] namei: obey trailing magic-link DAC permissions Date: Fri, 12 Jul 2019 07:36:18 +0100 Message-ID: <20190712063617.GJ17978@ZenIV.linux.org.uk> References: <20190706145737.5299-1-cyphar@cyphar.com> <20190706145737.5299-2-cyphar@cyphar.com> <20190712041454.GG17978@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20190712041454.GG17978@ZenIV.linux.org.uk> Sender: linux-kernel-owner@vger.kernel.org To: Aleksa Sarai Cc: Jeff Layton , "J. Bruce Fields" , Arnd Bergmann , David Howells , Shuah Khan , Shuah Khan , Andy Lutomirski , Christian Brauner , Eric Biederman , Andrew Morton , Alexei Starovoitov , Kees Cook , Jann Horn , Tycho Andersen , David Drysdale , Chanho Min , Oleg Nesterov , Aleksa Sarai , Linus Torvalds , containers@lists.linux-foundation.org, linux-alpha@vger.kernel.org List-Id: linux-arch.vger.kernel.org On Fri, Jul 12, 2019 at 05:14:54AM +0100, Al Viro wrote: > That's not quite guaranteed (it is possible to bind a symlink on top > of a regular file, and you will get LOOKUP_JUMPED on the entry into > trailing_symlink() when looking the result up). Moreover, why bother > with LOOKUP_JUMPED here? See that > nd->last_type = LAST_BIND; > several lines prior? That's precisely to be able to recognize those > suckers. ... except that this won't work these days (once upon a time it used to, but that had been a long time ago). However, that doesn't change the fact that the test is really wrong. So let's do it right: * set a new flag along with LOOKUP_JUMPED in nd_jump_link() * clear it in get_link() right before res = READ_ONCE(inode->i_link); * check it in trailing_symlink() (or callers thereof) The rest of comments stand, AFAICS. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from zeniv.linux.org.uk ([195.92.253.2]:33532 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725562AbfGLGgu (ORCPT ); Fri, 12 Jul 2019 02:36:50 -0400 Date: Fri, 12 Jul 2019 07:36:18 +0100 From: Al Viro Subject: Re: [PATCH v9 01/10] namei: obey trailing magic-link DAC permissions Message-ID: <20190712063617.GJ17978@ZenIV.linux.org.uk> References: <20190706145737.5299-1-cyphar@cyphar.com> <20190706145737.5299-2-cyphar@cyphar.com> <20190712041454.GG17978@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190712041454.GG17978@ZenIV.linux.org.uk> Sender: linux-arch-owner@vger.kernel.org List-ID: To: Aleksa Sarai Cc: Jeff Layton , "J. Bruce Fields" , Arnd Bergmann , David Howells , Shuah Khan , Shuah Khan , Andy Lutomirski , Christian Brauner , Eric Biederman , Andrew Morton , Alexei Starovoitov , Kees Cook , Jann Horn , Tycho Andersen , David Drysdale , Chanho Min , Oleg Nesterov , Aleksa Sarai , Linus Torvalds , containers@lists.linux-foundation.org, linux-alpha@vger.kernel.org, linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-ia64@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-m68k@lists.linux-m68k.org, linux-mips@vger.kernel.org, linux-parisc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, linux-sh@vger.kernel.org, linux-xtensa@linux-xtensa.org, sparclinux@vger.kernel.org Message-ID: <20190712063618.NDG-wQ-cByOheSporBxZHGmwQWhKLPiWniMyXjbW4es@z> On Fri, Jul 12, 2019 at 05:14:54AM +0100, Al Viro wrote: > That's not quite guaranteed (it is possible to bind a symlink on top > of a regular file, and you will get LOOKUP_JUMPED on the entry into > trailing_symlink() when looking the result up). Moreover, why bother > with LOOKUP_JUMPED here? See that > nd->last_type = LAST_BIND; > several lines prior? That's precisely to be able to recognize those > suckers. ... except that this won't work these days (once upon a time it used to, but that had been a long time ago). However, that doesn't change the fact that the test is really wrong. So let's do it right: * set a new flag along with LOOKUP_JUMPED in nd_jump_link() * clear it in get_link() right before res = READ_ONCE(inode->i_link); * check it in trailing_symlink() (or callers thereof) The rest of comments stand, AFAICS.