From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [PATCH 4/4] Allow unprivileged chroot when safe Date: Mon, 16 Jan 2012 12:15:09 -0800 Message-ID: References: <20120116200618.GN23916@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: Casey Schaufler , Linus Torvalds , Jamie Lokier , Will Drewry , linux-kernel@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, serge.hallyn@canonical.com, coreyb@linux.vnet.ibm.com, pmoore@redhat.com, eparis@redhat.com, djm@mindrot.org, segoon@openwall.com, rostedt@goodmis.org, jmorris@namei.org, scarybeasts@gmail.com, avi@redhat.com, penberg@cs.helsinki.fi, mingo@elte.hu, akpm@linux-foundation.org, khilman@ti.com, borislav.petkov@amd.com, amwang@redhat.com, oleg@redhat.com, ak@linux.intel.com, eric.dumazet@gmail.com, gregkh@suse.de, dhowells@redhat.com, daniel.lezcano@free.fr, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, olofj@chromium.org, mhalcrow@google.com, dlaor@redhat.com, corbet@lwn.net, alan@lxorguk.ukuu.org.uk To: Al Viro Return-path: In-Reply-To: <20120116200618.GN23916@ZenIV.linux.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Mon, Jan 16, 2012 at 12:06 PM, Al Viro wro= te: > On Sun, Jan 15, 2012 at 04:37:21PM -0800, Andy Lutomirski wrote: > >> + =A0 =A0 is_chrooted =3D (fs->root.mnt->mnt_mountpoint !=3D >> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0fs->root.mnt->mnt_parent->m= nt_root || >> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0fs->root.dentry !=3D fs->ro= ot.mnt->mnt_root); > > Folks, is it _that_ hard to at least try to compile your patches? =A0= Hint: > this one will *not*. =A0That sad detail aside, this test would have b= een > a pile of garbage even on the kernels that used to have mnt_mountpoin= t > in struct vfsmount. =A0What *are* you trying to test here? =A0The las= t part > at least does make some sense - it's "process root happens to be the > root of some vfsmount". =A0The first part, though, makes no sense wha= tsoever; > it's "... and that vfsmount is mounted on top of root of some other > vfsmount". I compiled it, booted it, and tested it. I based it off an oldish kernel, though, so I can rebase. The first approach I tried was (from memory -- may not compile at all on any version) fs->root.mnt !=3D fs->root.mnt->mnt_parent. That didn'= t work. The issue is that on dracut-based distros, AFAICT, the root (in the sense of the root of the tree of struct vfsmounts) is rootfs. The apparent root (the filesystem containing /, /usr, etc) is mounted on top of (rootfs)/. Dracut then does something with the effect of chroot("/"). So you end up with the vfsmount that contains "/" not being the actual root vfsmount. But there's nothing hidden by the chroot -- even if fs->root.mnt pointed at rootfs, "/" would still follow the mountpoint into the actual filesystem. An different approach would be to have fs_struct keep track of a hard and a soft root. chroot would stay CAP_SYS_ADMIN only and change both roots. A new unprivileged_chroot would change only the soft root. follow_dotdot would check both, so unprivileged_chroot wouldn't be useful for breaking chroot. The big downside would be an extra branch on every follow_dotdot. --Andy