From: Al Viro <viro@ZenIV.linux.org.uk>
To: Pavel Machek <pavel@ucw.cz>
Cc: Jeff Layton <jlayton@redhat.com>,
Jamie Lokier <jamie@shareable.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
miklos@szeredi.hu
Subject: Re: [PATCH 0/3] vfs: plug some holes involving LAST_BIND symlinks and file bind mounts (try #5)
Date: Sun, 20 Dec 2009 21:23:40 +0000 [thread overview]
Message-ID: <20091220212340.GO18217@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20091220210619.GK23917@elf.ucw.cz>
On Sun, Dec 20, 2009 at 10:06:19PM +0100, Pavel Machek wrote:
> > > Consider FD passing over unix socket. Passing R/O file descriptor to
> > > the other task, then having the task write to the file is certainly bad.
> >
> > You've omitted the "R/O file descriptor of a file that is writable for
> > that other task" part...
>
> That is 666 for the other task. But the other task can't access it due
> to directory being 700 or something. Your fchdir() argument does not
> apply here.
*snort*
What you are advocating is a very limited class of setups that might be
usable for protecting files if not for the existing behaviour on a shitload
of systems.
The thing is, that class *is* very limited. E.g. introduce links and it's
fallen apart. Introduce bindings and the same will happen. Just try to
extend it one level deeper and fchdir() will bite you, etc. All of that
is not dependent on procfs even being there.
Access rights belong to file, not to a pathname (and there's no such thing
as _the_ pathname of a file).
I'd buy that as a minor QoI issue; as a security one - no way.
next prev parent reply other threads:[~2009-12-20 21:23 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-11-23 17:41 [PATCH 0/3] vfs: plug some holes involving LAST_BIND symlinks and file bind mounts (try #5) Jeff Layton
2009-11-23 17:41 ` [PATCH 1/3] vfs: force reval of target when following LAST_BIND symlinks Jeff Layton
2009-11-23 17:41 ` [PATCH 2/3] vfs: force reval on dentry of bind mounted files on FS_REVAL_DOT filesystems Jeff Layton
2009-11-23 17:41 ` [PATCH 3/3] vfs: check path permissions on target of LAST_BIND symlinks Jeff Layton
2009-11-23 22:05 ` [PATCH 0/3] vfs: plug some holes involving LAST_BIND symlinks and file bind mounts (try #5) Eric W. Biederman
2009-11-23 22:36 ` Jeff Layton
2009-11-23 22:49 ` Jamie Lokier
2009-11-23 23:15 ` Jeff Layton
2009-11-23 23:35 ` Eric W. Biederman
2009-11-24 0:34 ` Jeff Layton
2009-11-24 1:20 ` Jamie Lokier
2009-11-24 11:26 ` Jeff Layton
2009-11-24 11:53 ` Miklos Szeredi
2009-11-24 12:09 ` Pavel Machek
2009-11-24 12:59 ` Miklos Szeredi
2009-11-30 12:28 ` Pavel Machek
2009-11-30 19:21 ` Eric W. Biederman
2009-11-24 13:13 ` Duane Griffin
2009-11-30 19:00 ` Jamie Lokier
2009-12-01 8:56 ` Duane Griffin
2009-12-16 12:31 ` Al Viro
2009-12-20 19:59 ` Pavel Machek
2009-12-20 21:04 ` Al Viro
2009-12-20 21:06 ` Pavel Machek
2009-12-20 21:23 ` Al Viro [this message]
2010-01-01 15:40 ` Pavel Machek
2010-01-10 4:42 ` Al Viro
2009-12-01 13:15 ` Jeff Layton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20091220212340.GO18217@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=ebiederm@xmission.com \
--cc=jamie@shareable.org \
--cc=jlayton@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=pavel@ucw.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).