From: Amir Goldstein <amir73il@gmail.com>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: Christian Brauner <brauner@kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>, Jan Kara <jack@suse.cz>,
Paul Moore <paul@paul-moore.com>,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
linux-fsdevel@vger.kernel.org, linux-unionfs@vger.kernel.org
Subject: [PATCH 2/3] fs: use file_fake_path() to get path of mapped files for display
Date: Fri, 9 Jun 2023 10:32:38 +0300 [thread overview]
Message-ID: <20230609073239.957184-3-amir73il@gmail.com> (raw)
In-Reply-To: <20230609073239.957184-1-amir73il@gmail.com>
/proc/$pid/maps and /proc/$pid/exe contain display paths of mapped file.
audot and tomoyo also log the display path of the mapped exec file.
When the mapped file comes from overlayfs, we need to use the macro
file_fake_path() to make sure that we get the fake overlayfs path and
not the real internal path.
At the time of this commit, file_fake_path() always returns f_path,
where overlayfs has stored the fake overlayfs path, but soon we are
going to change the location that the fake path is stored.
Cc: Paul Moore <paul@paul-moore.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---
fs/proc/base.c | 8 +++++---
fs/seq_file.c | 2 +-
kernel/audit.c | 3 ++-
kernel/fork.c | 5 +++--
security/tomoyo/util.c | 3 ++-
5 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 05452c3b9872..d6f8c77a3e38 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1730,8 +1730,9 @@ static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
exe_file = get_task_exe_file(task);
put_task_struct(task);
if (exe_file) {
- *exe_path = exe_file->f_path;
- path_get(&exe_file->f_path);
+ /* Overlayfs mapped files have fake path */
+ *exe_path = *file_fake_path(exe_file);
+ path_get(exe_path);
fput(exe_file);
return 0;
} else
@@ -2218,7 +2219,8 @@ static int map_files_get_link(struct dentry *dentry, struct path *path)
rc = -ENOENT;
vma = find_exact_vma(mm, vm_start, vm_end);
if (vma && vma->vm_file) {
- *path = vma->vm_file->f_path;
+ /* Overlayfs mapped files have fake path */
+ *path = *file_fake_path(vma->vm_file);
path_get(path);
rc = 0;
}
diff --git a/fs/seq_file.c b/fs/seq_file.c
index f5fdaf3b1572..7e65fde4336a 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -497,7 +497,7 @@ EXPORT_SYMBOL(seq_path);
*/
int seq_file_path(struct seq_file *m, struct file *file, const char *esc)
{
- return seq_path(m, &file->f_path, esc);
+ return seq_path(m, file_fake_path(file), esc);
}
EXPORT_SYMBOL(seq_file_path);
diff --git a/kernel/audit.c b/kernel/audit.c
index 9bc0b0301198..91975f139a03 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2202,7 +2202,8 @@ void audit_log_d_path_exe(struct audit_buffer *ab,
if (!exe_file)
goto out_null;
- audit_log_d_path(ab, " exe=", &exe_file->f_path);
+ /* Overlayfs mapped files have fake path */
+ audit_log_d_path(ab, " exe=", file_fake_path(exe_file));
fput(exe_file);
return;
out_null:
diff --git a/kernel/fork.c b/kernel/fork.c
index ed4e01daccaa..9a3c138a677e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1455,8 +1455,9 @@ int replace_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file)
for_each_vma(vmi, vma) {
if (!vma->vm_file)
continue;
- if (path_equal(&vma->vm_file->f_path,
- &old_exe_file->f_path)) {
+ /* Overlayfs mapped files have fake path */
+ if (path_equal(file_fake_path(vma->vm_file),
+ file_fake_path(old_exe_file))) {
ret = -EBUSY;
break;
}
diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index 6799b1122c9d..ff0d94fb431c 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -975,7 +975,8 @@ const char *tomoyo_get_exe(void)
if (!exe_file)
return NULL;
- cp = tomoyo_realpath_from_path(&exe_file->f_path);
+ /* Overlayfs mapped files have fake path */
+ cp = tomoyo_realpath_from_path(file_fake_path(exe_file));
fput(exe_file);
return cp;
}
--
2.34.1
next prev parent reply other threads:[~2023-06-09 7:34 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-09 7:32 [PATCH 0/3] Reduce impact of overlayfs fake path files Amir Goldstein
2023-06-09 7:32 ` [PATCH 1/3] fs: use fake_file container for internal files with fake f_path Amir Goldstein
2023-06-09 11:32 ` Christian Brauner
2023-06-09 11:57 ` Amir Goldstein
2023-06-09 12:12 ` Christian Brauner
2023-06-09 12:20 ` Amir Goldstein
2023-06-09 12:54 ` Christian Brauner
2023-06-09 13:00 ` Christian Brauner
2023-06-09 13:09 ` Amir Goldstein
2023-06-11 19:11 ` Amir Goldstein
2023-06-12 7:55 ` Christian Brauner
2023-06-09 7:32 ` Amir Goldstein [this message]
2023-06-09 8:19 ` [PATCH 2/3] fs: use file_fake_path() to get path of mapped files for display Miklos Szeredi
2023-06-09 7:32 ` [PATCH 3/3] fs: store fake path in file_fake along with real path Amir Goldstein
2023-06-09 11:12 ` Christian Brauner
2023-06-09 11:30 ` Amir Goldstein
2023-06-09 13:15 ` [PATCH 0/3] Reduce impact of overlayfs fake path files Miklos Szeredi
2023-06-09 14:28 ` Amir Goldstein
2023-06-09 14:42 ` Amir Goldstein
2023-06-09 15:00 ` Miklos Szeredi
2023-06-09 19:17 ` Amir Goldstein
2023-06-12 7:57 ` Christian Brauner
2023-10-02 15:32 ` Amir Goldstein
2023-10-04 15:29 ` Amir Goldstein
2023-06-09 15:27 ` Mimi Zohar
2023-06-09 13:15 ` Tetsuo Handa
2023-06-09 13:54 ` Amir Goldstein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230609073239.957184-3-amir73il@gmail.com \
--to=amir73il@gmail.com \
--cc=brauner@kernel.org \
--cc=jack@suse.cz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).